MIVA Merchant "merchant.mvc" Cross Site Scripting Vulnerability

[TJ]

* Technical Description *

A vulnerability has been identified in MIVA Merchant, which may be exploited by attackers to inject malicious HTML code. This flaw is due to an input validation error in "merchant.mvc" when processing a specially crafted "Customer_Login" parameter, which may be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser.

 * Affected Products *

MIVA Merchant version 5 and prior

 * Solution *

Apply patch core-4 :
http://smallbusiness.miva.com/products/merchant/

 * References *

http://www.frsirt.com/english/advisories/2005/1758