Multiple cross-site scripting (XSS) vulnerabilities in Chamberland Technology ezWaiter 3.0 Online and possibly Enterprise Software (aka enterprise edition) allow remote attackers to inject arbitrary web script or HTML via the (1) itemfor (aka Who is this item for?) and (2) special (aka Special Instructions) parameters to item.php, which is accessed from showorder.php, or (3) unspecified parameters to the login form at login.php.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ezwaiter_online | Chamberland_technology | 3.0 (including) | 3.0 (including) |
References
- http://www.securityfocus.com/archive/1/438792/100/0/threaded
- http://www.securityfocus.com/bid/18746
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27587
- http://www.securityfocus.com/archive/1/438792/100/0/threaded
- http://www.securityfocus.com/bid/18746
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27587