CVE:CVE-2004-0675
CNNVD:CNNVD-200408-019
Cart32网上购物系统里的(1) cart32.exe或(2) c32web.exe存在跨站脚本攻击(XSS)漏洞。远程攻击者借助GetLatestBuilds命令的cart32参数执行任意web脚本。
solution:Upgrade mcmurtrey_whitaker_and_associates cart32 to a higher version than 2.5a,2.6,3.0,3.1,3.5,3.5_build619,3.5a,3.5a_build710,4.4,5.0,and avoid the version 2.5a,2.6,3.0,3.1,3.5,3.5_build619,3.5a,3.5a_build710,4.4,5.0