Secunia

A vulnerability has been reported in A-Cart, which can be exploited by malicious people to conduct Cross-Site Scripting attacks against visitors.

The vulnerability is caused due to an input validation error in various scripts when handling input supplied to the "msg" parameter.

Example:
http://[victim]/[acart_path]/signin.asp?msg=<script>alert(document.cookie)</script>

Successful exploitation results in the script code being executed in a user's browser session. This can result in disclosure of various information (eg. cookie-based authentication information) associated with the site running A-Cart or inclusion of malicious content, which the user thinks is part of the real website.

The vulnerability has been reported in version 2.0 and Pro.

Solution
Filter malicious characters in a HTTP proxy or firewall with URL filtering capabilities.
Further details available in Customer Area

Provided and/or discovered by
G00db0y (Zone-H)

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area