Secunia

Nick Gudov has reported some vulnerabilities in CFWebstore, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

1) User input passed to the "category_id", "product_id", and "feature_id" parameters in "index.cfm" is not sanitised properly before being used in a SQL query. This can be exploited to manipulate the SQL query by injecting arbitrary SQL code.

2) User input supplied in an URL is not sanitised properly before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's current browser session in context of an affected site.

Successful exploitation may result in exposure of various information (eg. cookie-based authentication information) associated with the site running CFWebstore or inclusion of malicious content, which the user thinks is part of the real website.

The vulnerabilities have been reported in version 5.0.

Solution
Update to version 5.0.1.
Further details available in Customer Area

Provided and/or discovered by
Nick Gudov, S-Quadra.

Original Advisory
http://www.s-quadra.com/advisories/Adv-20040312.txt

Deep Links
Links available in Customer Area