CubeCart Multiple Cross-Site Scripting and SQL Injection Vulnerabilities

Summary
This host is running CubeCart and is prone to SQL injection and multiple cross-site scripting vulnerabilities.
Impact
Successful exploitation will let attackers to execute arbitrary HTML and script code in a user's browser session in context of an affected site and manipulate SQL queries by injecting arbitrary SQL code. Impact Level: Application.
Solution
Upgrade to CubeCart version 4.4.2 or later For updates refer to http://www.cubecart.com/tour
Insight
The flaws are due to - Input passed to the 'amount', 'cartId', 'email', 'transId', and 'transStatus' parameters in 'modules/gateway/WorldPay/return.php' is not properly sanitised before being returned to the user. - Input passed via the 'searchStr' parameter to index.php (when '_a' is set to 'viewCat') is not properly sanitised before being used in a SQL query.
Affected
CubeCart version 4.3.3
References