Secunia

A vulnerability has been reported in DIC shop_v50 and shop_v52, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to unspecified parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected website.

The vulnerabilities are reported in DIC shop_v50 version 3.0 and earlier and shop_v52 version 2.0 and earlier. Other versions may also be affected.

Solution
The vendor has issued an updated version.

Provided and/or discovered by
JVN credits Mr. Syuuya Ueki.

Changelog
Further details available in Customer Area

Original Advisory
http://jvn.jp/jp/JVN79914432/index.html

Deep Links
Links available in Customer Area