Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug mode is enabled, allows remote attackers to execute Javascript on other clients via the cart_id parameter.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| steve_kneizys | agora.cgi | 3.3e |
| steve_kneizys | agora.cgi | 3.3b |
| steve_kneizys | agora.cgi | 3.3i |
| steve_kneizys | agora.cgi | 4.0 |
| steve_kneizys | agora.cgi | 3.3f |
| steve_kneizys | agora.cgi | 3.2n |
| steve_kneizys | agora.cgi | 3.2a |
| steve_kneizys | agora.cgi | 4.0b |
| steve_kneizys | agora.cgi | 3.2r |
| steve_kneizys | agora.cgi | 3.2d |
| steve_kneizys | agora.cgi | 3.2i |
| steve_kneizys | agora.cgi | 3.2m |
| steve_kneizys | agora.cgi | 3.2h |
| steve_kneizys | agora.cgi | 3.2e |
| steve_kneizys | agora.cgi | 3.2 |
| steve_kneizys | agora.cgi | 3.2p |
| steve_kneizys | agora.cgi | 4.0c |
| steve_kneizys | agora.cgi | 3.2c |
| steve_kneizys | agora.cgi | 4.0a |
| steve_kneizys | agora.cgi | 3.2ja |
| steve_kneizys | agora.cgi | 3.2b |
| steve_kneizys | agora.cgi | 3.2l |
| steve_kneizys | agora.cgi | 3.2k |
| steve_kneizys | agora.cgi | 3.3d |
| steve_kneizys | agora.cgi | 4.0d |
| steve_kneizys | agora.cgi | 3.3a |
| steve_kneizys | agora.cgi | 3.2g |
| steve_kneizys | agora.cgi | 3.3c |
| steve_kneizys | agora.cgi | 3.3j |
| steve_kneizys | agora.cgi | 3.2j |
| steve_kneizys | agora.cgi | 3.2q |
| steve_kneizys | agora.cgi | 3.2f |
Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a non-existent .html file, which leaks the pathname in an error message.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| steve_kneizys | agora.cgi | 3.3e |
| steve_kneizys | agora.cgi | 3.3b |
| steve_kneizys | agora.cgi | 3.3i |
| steve_kneizys | agora.cgi | 4.0 |
| steve_kneizys | agora.cgi | 3.3f |
| steve_kneizys | agora.cgi | 3.2n |
| steve_kneizys | agora.cgi | 3.2a |
| steve_kneizys | agora.cgi | 4.0b |
| steve_kneizys | agora.cgi | 3.2r |
| steve_kneizys | agora.cgi | 3.2d |
| steve_kneizys | agora.cgi | 3.2i |
| steve_kneizys | agora.cgi | 3.2m |
| steve_kneizys | agora.cgi | 3.2h |
| steve_kneizys | agora.cgi | 3.2e |
| steve_kneizys | agora.cgi | 3.2 |
| steve_kneizys | agora.cgi | 3.2p |
| steve_kneizys | agora.cgi | 4.0c |
| steve_kneizys | agora.cgi | 3.2c |
| steve_kneizys | agora.cgi | 4.0a |
| steve_kneizys | agora.cgi | 3.2ja |
| steve_kneizys | agora.cgi | 3.2b |
| steve_kneizys | agora.cgi | 3.2l |
| steve_kneizys | agora.cgi | 3.2k |
| steve_kneizys | agora.cgi | 3.3d |
| steve_kneizys | agora.cgi | 4.0d |
| steve_kneizys | agora.cgi | 3.3a |
| steve_kneizys | agora.cgi | 3.2g |
| steve_kneizys | agora.cgi | 3.3c |
| steve_kneizys | agora.cgi | 3.3j |
| steve_kneizys | agora.cgi | 3.2j |
| steve_kneizys | agora.cgi | 4.0e |
| steve_kneizys | agora.cgi | 3.2q |
| steve_kneizys | agora.cgi | 3.2f |