Lucene search

[email protected]CVE-2007-2862

HistoryMay 24, 2007 - 7:30 p.m.

CVE-2007-2862

2007-05-2419:30:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2007-2862

sql injection

cubecart

remote attack

arbitrary commands

9.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.5%

JSON

Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie modification.

CPENameOperatorVersion
devellion:cubecartdevellion cubecarteq3.0.16

CPE	Name	Operator	Version
devellion:cubecart	devellion cubecart	eq	3.0.16

References

osvdb.org/38100

securityreason.com/securityalert/2730

www.securityfocus.com/archive/1/469301/100/0/threaded

www.securityfocus.com/bid/24100

exchange.xforce.ibmcloud.com/vulnerabilities/34460

9.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.5%

JSON

Related for CVE-2007-2862

prion1