CVE-2008-6985
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
69.0%
Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| zen-cart | zen_cart | 1.2.0d | cpe:2.3:a:zen-cart:zen_cart:1.2.0d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.1_patch1 | cpe:2.3:a:zen-cart:zen_cart:1.2.1_patch1:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.1d | cpe:2.3:a:zen-cart:zen_cart:1.2.1d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.2d | cpe:2.3:a:zen-cart:zen_cart:1.2.2d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.3d | cpe:2.3:a:zen-cart:zen_cart:1.2.3d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.4.1 | cpe:2.3:a:zen-cart:zen_cart:1.2.4.1:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.4d | cpe:2.3:a:zen-cart:zen_cart:1.2.4d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.5d | cpe:2.3:a:zen-cart:zen_cart:1.2.5d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.2.6d | cpe:2.3:a:zen-cart:zen_cart:1.2.6d:*:*:*:*:*:*:* |
| zen-cart | zen_cart | 1.3 | cpe:2.3:a:zen-cart:zen_cart:1.3:*:*:*:*:*:*:* |
References
secunia.com/advisories/31758
www.gulftech.org/?node=research&article_id=00129-09042008
www.osvdb.org/48346
www.securityfocus.com/archive/1/496002/100/0/threaded
www.securityfocus.com/archive/1/496032/100/100/threaded
www.securityfocus.com/bid/31023
www.zen-cart.com/forum/showthread.php?p=604473
exchange.xforce.ibmcloud.com/vulnerabilities/44917
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
69.0%