CVE-2011-0451

Name of the Vulnerable Software and Affected Versions EC-CUBE versions prior to 2.4.4

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, due to multiple cross-site scripting (XSS) vulnerabilities in the data/Smarty/templates/default/list.tpl and data/Smarty/templates/default/campaign/bloc/cart tag.tpl templates.

Recommendations For versions prior to 2.4.4, update to version 2.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable templates data/Smarty/templates/default/list.tpl and data/Smarty/templates/default/campaign/bloc/cart tag.tpl to minimize the risk of exploitation.