Russ McRee has discovered some vulnerabilities in DFD Cart, which can be exploited by malicious people to conduct cross-site scripting and cross-site request forgery attacks.

1) Input passed to the "category" parameter in your.order.php and to the "category" and "list_quantity" parameters in index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

2) The application allows users to perform certain actions via HTTP requests send to e.g. admin/configure.php without performing any validity checks to verify the request. This can be exploited to e.g. conduct script-insertion attacks and change certain settings by tricking an administrator into visiting a malicious website.

The vulnerabilities are confirmed in version 1.197 and 1.198. Other versions may also be affected.

Solution
Update to version 1.2.

Provided and/or discovered by
Reported by Russ McRee, HolisticInfoSec via Secunia.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://holisticinfosec.org/content/view/135/45/
http://sourceforge.net/projects/dfdcart/files/dfdcart/1.2X/ChangeLog.txt/download

Deep Links
Links available to Secunia VIM customers