CVE-2004-1797

Vulnerability

FreznoShop versions 1.3.0 RC1 and earlier contain a cross-site scripting (XSS) vulnerability in the search.php script. This flaw allows remote attackers to inject arbitrary web script or HTML code by manipulating the search parameter [1].

Exploitation

An attacker can craft a malicious link that includes arbitrary HTML and script code within the search parameter of the search.php script. If a victim user clicks on this link, the attacker-supplied code will be executed within the security context of the website hosting FreznoShop [1].

Impact

Successful exploitation of this vulnerability can lead to the theft of cookie-based authentication credentials. Other malicious actions are also possible, depending on the injected script [1].

Mitigation

FreznoShop versions 1.3.0 RC1 and earlier are affected. No specific patched version or release date is available in the provided references. It is recommended to upgrade to a non-vulnerable version once available. Information regarding workarounds or if the software is end-of-life (EOL) is not disclosed in the available references [1].