FKIE_CVE-2010-1328

Vulnerability from fkie_nvd - Published: 2010-07-06 17:17 - Updated: 2026-06-16 23:18
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tipo or (2) destino parameter to login_registrese.php3 in the Services section, (3) the rubro parameter to precios.php3 in the Products section, (4) the arti parameter to recomenda_articulo.php3 in the Products section, (5) the descrip parameter in a profile action to control/abm_det.php3 in the e-Commerce section, (6) the tit parameter in a delivery_courier action to control/abm_list.php3 in the e-Commerce section, or (7) the tit parameter in an usuario action to control/abm_det.php3 in the e-Commerce section.
References
cve@mitre.orghttp://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-xss-0107.phpExploit
cve@mitre.orghttp://www.securityfocus.com/bid/41233Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/59951
af854a3a-2127-422b-91ae-364da2661108http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-xss-0107.phpExploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/41233Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/59951
Impacted products
Vendor Product Version
tornadostore tornadostore *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tornadostore:tornadostore:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D36B3D6-B89F-40DD-BFDE-F1806CB5A64D",
              "versionEndIncluding": "1.4.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tipo or (2) destino parameter to login_registrese.php3 in the Services section, (3) the rubro parameter to precios.php3 in the Products section, (4) the arti parameter to recomenda_articulo.php3 in the Products section, (5) the descrip parameter in a profile action to control/abm_det.php3 in the e-Commerce section, (6) the tit parameter in a delivery_courier action to control/abm_list.php3 in the e-Commerce section, or (7) the tit parameter in an usuario action to control/abm_det.php3 in the e-Commerce section."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples secuencias de comandos en sitios cruzados (XSS) en  TornadoStore v1.4.3 y anteriores permite a atacantes remotso inyectar c\u00f3digo web o HTML de su elecci\u00f3n a trav\u00e9s de par\u00e1metro (1) tipo o (2) destino en login_registrese.php3 en la secci\u00f3n Services , (3) el par\u00e1metro rubro en precios.php3 en la secci\u00f3n Products, (4) el par\u00e1metro arti en recomenda_articulo.php3 en la secci\u00f3n Products, (5) el par\u00e1metro descrip en una acci\u00f3n en control/abm_det.php3 en la secci\u00f3n e-Commerce, (6) el par\u00e1metro tit en una acci\u00f3n delivery_courier en control/abm_list.php3 en la secci\u00f3n e-Commerce o (7) el par\u00e1metro tit en una acci\u00f3n usuario en control/abm_det.php3 en la secci\u00f3n e-Commerce."
    }
  ],
  "id": "CVE-2010-1328",
  "lastModified": "2026-06-16T23:18:08.660",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-07-06T17:17:13.170",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-xss-0107.php"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/41233"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59951"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-xss-0107.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/41233"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59951"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.