CVE-2009-2587

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.26%

Published

Jul 24, 2009

Modified

Apr 22, 2026

Public PoC / Exploit (7)

All weaponized →

Exploit-DBDragDropCart - '/assets/js/ddcart.php?sid' Cross-Site Scripting Exploit-DBDragDropCart - '/includes/ajax/getstate.php?prefix' Cross-Site Scripting Exploit-DBDragDropCart - 'index.php?search' Cross-Site Scripting Exploit-DBDragDropCart - 'login.php?redirect' Cross-Site Scripting Exploit-DBDragDropCart - 'productdetail.php?product' Cross-Site Scripting Exploit-DBDragDropCart - 'search.php?search' Cross-Site Scripting TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to assets/js/ddcart.php, the (2) prefix parameter to includes/ajax/getstate.php, the search parameter to (3) index.php and (4) search.php, the (5) redirect parameter to login.php, and the (6) product parameter to productdetail.php.

Weaknesses (CWE)

CWE-79

Affected Products (1)

dragdropcart · dragdropcartvulnerable

References (18)

http://packetstormsecurity.org/0907-exploits/dragdopcart-xss.txt

Exploit

http://secunia.com/advisories/35925

Vendor Advisory

http://www.osvdb.org/56065

http://www.osvdb.org/56066

http://www.osvdb.org/56067