CVE-2012-4236

MEDIUM 4.3CVE-2012-4236 · Published 20/08/2012 · updated 16/06/2026

In short

CVE-2012-4236 is a MEDIUM (CVSS 4.3) vulnerability affecting ecommerce (totalshopuk).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ecommerce totalshopuk	`= 1.0= 1.1= 1.2= 1.3= 1.3.1= 1.3.2= 1.3.3= 1.4.0= 1.4.1= 1.5.0= 1.5.0.1= 1.5.1= 1.5.2= 1.5.3= 1.5.4= 1.6.0= 1.6.1= 1.6.2= 1.6.3= 1.7= 1.7.0= 1.7.1= 1.7.2= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.1.0= 2.1.1≤ 2.1.2`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the refresh_page function in application/modules/_main/views/_top.php in Total Shop UK eCommerce Open Source before 2.1.2_p1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

References

secunia.com/advisories/50238 · Vendor Advisory
openwall.com/lists/oss-security/2012/08/13/7
reactionpenetrationtesting.co.uk/totalshop-uk-generic-xss.html · Exploit
securityfocus.com/bid/54985 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free