Cross-Site Request Forgery (CSRF) in microweber/microweber

✍️ Description microweber is vulnerable to Cross-site request forgery. The app is not checking the CSRF token when adding new products to the cart. 🕵️‍♂️ Proof of Concept HTML content: HTML setTimeout = form.submit; , 2000; 1. Save the above content into an HTML file. 2. Open the file on the...

Business Logic Errors in microweber/microweber

✍️ Description microweber is vulnerable to Business Logic error through negative product price. 🕵️‍♂️ Proof of Concept HTML content: HTML 1. Save the above content into an HTML file. 2. Access the app localhost and add a product to the cart. 3. Open the HTML file and click on submit button to take...

X-Cart Concierge Module Information Disclosure

X-Cart Concierge module has been detected on the target X-Cart installation. This may present an attacker with sensitive information to mount further attacks & may leak the admin account email used to log into the store, official company name, license type of the store and other sensitive data No...

X-Cart 5.0.10 < 5.3.6.8 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

X-Cart 5.0.10 < 5.3.6.5 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.5. It is, therefore, affected by various security issues in the Core, GoSocial, ThemeTweaker & RESTAPI modules. Note that the scanner has not tested for these issue...

X-Cart 5.4.0.x < 5.4.0.13 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

X-Cart 5.4.1.x < 5.4.1.8 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

X-Cart 4.4.0 < 4.7.11 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 4.4.0 4.7.10. It is, therefore, affected by multiples vulnerabilities : - A SQL injection vulnerability. - A Cross-Site Scripting XSS against embedded jQuery component. Note tha...

X-Cart 5.0.10 < 5.3.6.1 Cross-Site Scripting

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.1. It is, therefore, affected by a XSS via the CategoryFilter2 parameter. Note that the scanner has not tested for these issues but has instead relied only on the...

X-Cart 5.0.10 < 5.3.3.0 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.3.0. It is, therefore, affected by multiples vulnerabilities : - A Remote Code execution vulnerability due to insufficient checking of uploaded content. This...

X-Cart 5.0.10 < 5.2.18 Open Redirect

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.2.18. It is, therefore, affected by a vulnerability in the redirect functionality. Note that the scanner has not tested for these issues but has instead relied only on...

WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.0.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Abandoned Cart Recovery for WooCommerce plugin versions = 1.0.4. Solution Update the WordPress Abandoned Cart Recovery for WooCommerce plugin to the latest available version at least 1.0.4.1...

X-Cart Files Information Disclosure

X-Cart sensitive files have been detected on the target X-Cart installation. This may present an attacker with sensitive information to mount further attacks. No source data...

New Admin Portal for Akamai Enterprise Application Access

The definition of a user has evolved to comprise much more than an employee, making secure access to the right application, for the right user, at the right time difficult and complex. Akamai Enterprise Application Access EAA is a unique cloud architecture that closes all inbound firewall ports,...

WordPress Sunshine Photo Cart plugin <= 2.8.28 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Sunshine Photo Cart plugin versions = 2.8.28. Solution Update the WordPress Sunshine Photo Cart plugin to the latest available version at least 2.8.29...

SQL Injection in s-cart/core

✍️ Description Searching keyword in/scadmin/currency is vulnerable to SQL injection. This will allow a user to run arbitrary SQL queries and completely delete, edit, export or change all information in the database - potentially rendering the entire platform unusable. 🕵️‍♂️ Proof of Concept Login...

CVE-2021-33394

Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker...

Zen Cart 1.5.7 Cross Site Scripting Vulnerability

Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting Vulnerability in Zen Cart 1.5.7 Affected Software: Zen Cart Affected Versions: 1.5.7 Homepage: https://www.zen-cart.com/ Vulnerability: Cross-Site Scripting Severity: High Status: Fixed CVSS Score 3.0:...

The vulnerability of the Shopping Cart sub-component of the Oracle iStore component in the Oracle E-Business Suite system, which allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the Shopping Cart sub-component of the Oracle iStore component in the Oracle E-Business Suite system’s business automation solution is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device...

Cross-Site Scripting (XSS)

express-cart is vulnerable to cross-site scripting XSS. An attacker with administrative privileges is able to inject and execute arbitrary Javascript in a victim's browser...