PT-2017-8442

Name of the Vulnerable Software and Affected Versions Magento CE and EE versions prior to 2.0.6 Description The issue allows remote attackers to conduct PHP object injection attacks, enabling them to execute arbitrary PHP code. This is achieved by sending crafted serialized shopping cart data...

CVE-2016-10114

CVE-2016-10114 describes a SQL injection vulnerability in the Joomla! extension "aWeb Cart Watching System for Virtuemart" (versions before 2.6.1). The flaw allows remote attackers to execute arbitrary SQL commands via vectors involving categorysearch and smartSearch. Affected product is the aWeb...

CVE-2016-10114

SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via vectors involving categorysearch and smartSearch...

PT-2017-7741

Name of the Vulnerable Software and Affected Versions aWeb Cart Watching System for Virtuemart versions prior to 2.6.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via vectors involving categorysearch and smartSearch. Recommendations For...

CVE-2016-10114: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via vectors involving categorysearch and smartSearch...

wordpress plugin fs-shopping-cart cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin fs-shopping-cart, which allows attackers to frame malicio...

Joomla! Component aWeb Cart Watching System for Virtuemart 2.6.0 - SQL Injection

Joomla! Component aWeb Cart Watching System for Virtuemart 2.6.0 - SQL Injection Exploit Title: Sqli Blind Timebased on Joomla + Viertuemart + aweb-cartwatching-system/aweb-cartwatching = 2.6.0 Date: 28-12-2016 Software Link: http://awebsupport.com/products/aweb-cartwatching-system Exploit Author...

CS-Cart Unauthenticated XXE Vulnerability

CS-Cart is a PHP and MySQL based e-commerce software system developed by CS-Cart team. The system supports third-party software extensions, customized promotional strategies, product filtering definitions and more. A security vulnerability exists in several pages of CS-Cart version 4.3.10, which...

CS-Cart < 4.4.2 XXE Vulnerability

CS-Cart is prone to an XML external entity XXE injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CS-Cart Detection

Detection of CS-Cart The script sends a connection request to the server and attempts to detect the presence of CS-Cart and to extract its version SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CS-Cart 4.3.10 - XML External Entity Injection Vulnerability

Exploit for php platform in category web applications Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data -...

CS-Cart 4.3.10 Unauthenticated XXE Injection

Software : CS-Cart From vendor site CS-Cart is an impressive platform for users to any level of eCommerce experience. With loads of features at a great price, CS-Cart is a great shopping cart solution that will quickly enable your online store to do business. XXE I : Twimgo addon...

CS-Cart 4.3.10 - XML External Entity Injection

CS-Cart 4.3.10 - XML External Entity Injection Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data -...

CS-Cart 4.3.10 - XML External Entity Injection

Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data - action=addtocart&data=DATAOUTPUTHERE&format=xml a GET request will be se...

WP eCommerce <= 3.11.3 - SQL Injection in sessionid

From vendor: "This vulnerability only affects users who use eWay as their payment gateway, have Gold Cart activated, and are using the as-of-yet-unreleased Theme Engine 2.0. We believe the number of users affected is likely close to zero, due to these conditions – but still, we highly recommend...

WordPress Mini Cart Plugin <= 1.00.1 - Authenticated SQL Injection

This plugin is prone to an SQL injection vulnerability. It allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Mini Cart Plugin <= 1.00.1 - Authenticated SQL Injection

This plugin is prone to an SQL injection vulnerability. It allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

Mini Cart Plugin 1.00.1 - Authenticated SQL Injection

$REQUESTitem is not escaped. Url is accessible for user collaborator above. Url vulnerable : http://target/wp-admin/edit.php?page=mini-cart/itemform.php=0=edit...

WordPress FireStorm Shopping Cart Plugin <= 2.07.02 - SQL Injection

This plugin is prone to an SQL injection vulnerability. It allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

FireStorm Shopping Cart eCommerce Plugin 2.07.02 - Authenticated SQL Injection

$POST ‘pid’ is not escaped. Url is accessible for administrator user. Url with problem: http://localhost:1406/wp/wp-admin/admin.php?page=fssc-products=general=edit=0=0 http://target/wp-admin/admin.php?page=fssc-products&fp=general&f=edit&cid=0&pid=0+UNION+SELECT+name+FROM+wpterms+WHERE+termid=1...