CVE-2008-6986

2009-08-1905:24:52

CWE-89

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

8.2

Confidence

Low

EPSS

0.004

Percentile

73.1%

JSON

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.

Affected configurations

Nvd

Node

zen-cartzen_cartMatch1.3

zen-cartzen_cartMatch1.3.0.2

zen-cartzen_cartMatch1.3.2

zen-cartzen_cartMatch1.3.5

zen-cartzen_cartMatch1.3.6

zen-cartzen_cartMatch1.3.7

zen-cartzen_cartMatch1.3.8

zen-cartzen_cartMatch1.3.8a

VendorProductVersionCPE
zen-cartzen_cart1.3cpe:2.3:a:zen-cart:zen_cart:1.3:*:*:*:*:*:*:*
zen-cartzen_cart1.3.0.2cpe:2.3:a:zen-cart:zen_cart:1.3.0.2:*:*:*:*:*:*:*
zen-cartzen_cart1.3.2cpe:2.3:a:zen-cart:zen_cart:1.3.2:*:*:*:*:*:*:*
zen-cartzen_cart1.3.5cpe:2.3:a:zen-cart:zen_cart:1.3.5:*:*:*:*:*:*:*
zen-cartzen_cart1.3.6cpe:2.3:a:zen-cart:zen_cart:1.3.6:*:*:*:*:*:*:*
zen-cartzen_cart1.3.7cpe:2.3:a:zen-cart:zen_cart:1.3.7:*:*:*:*:*:*:*
zen-cartzen_cart1.3.8cpe:2.3:a:zen-cart:zen_cart:1.3.8:*:*:*:*:*:*:*
zen-cartzen_cart1.3.8acpe:2.3:a:zen-cart:zen_cart:1.3.8a:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zen-cart	zen_cart	1.3	cpe:2.3:a:zen-cart:zen_cart:1.3:::::::*
zen-cart	zen_cart	1.3.0.2	cpe:2.3:a:zen-cart:zen_cart:1.3.0.2:::::::*
zen-cart	zen_cart	1.3.2	cpe:2.3:a:zen-cart:zen_cart:1.3.2:::::::*
zen-cart	zen_cart	1.3.5	cpe:2.3:a:zen-cart:zen_cart:1.3.5:::::::*
zen-cart	zen_cart	1.3.6	cpe:2.3:a:zen-cart:zen_cart:1.3.6:::::::*
zen-cart	zen_cart	1.3.7	cpe:2.3:a:zen-cart:zen_cart:1.3.7:::::::*
zen-cart	zen_cart	1.3.8	cpe:2.3:a:zen-cart:zen_cart:1.3.8:::::::*
zen-cart	zen_cart	1.3.8a	cpe:2.3:a:zen-cart:zen_cart:1.3.8a:::::::*