CVE-2013-2314
29.05.2013, 19:55
Cross-site scripting (XSS) vulnerability in the adminAuthorization function in data/class/helper/SC_Helper_Session.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the management screen.
| Vendor | Product | Version |
|---|---|---|
| lockon | ec-cube | 2.11.0 |
| lockon | ec-cube | 2.11.1 |
| lockon | ec-cube | 2.11.2 |
| lockon | ec-cube | 2.11.3 |
| lockon | ec-cube | 2.11.4 |
| lockon | ec-cube | 2.11.5 |
| lockon | ec-cube | 2.12.0 |
| lockon | ec-cube | 2.12.1 |
| lockon | ec-cube | 2.12.2 |
| lockon | ec-cube | 2.12.3 |
| lockon | ec-cube | 2.12.3en:en |
| lockon | ec-cube | 2.12.3enp1:enp1 |
| lockon | ec-cube | 2.12.3enp2:enp2 |
𝑥
= Vulnerable software versions
References