CVE-2015-0951

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

CVE-2015-0951

CVE-2015-0951 affects X-Cart before 5.1.11, enabling a remote, authenticated attacker to read or delete address data of other users via manipulated update/remove requests (insecure direct object reference). The issue affects 5.1.10 and earlier per CNVD/NVD/Cert notes; vendor fix is X-Cart 5.1.11....

PT-2015-4989

Name of the Vulnerable Software and Affected Versions X-Cart versions 5.1.6 through 5.1.10 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the substring parameter in the "admin.php" file. Recommendations F...

CVE-2015-0951: Undefined Security Weakness

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

CVE-2015-0950: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

PT-2015-4990

Name of the Vulnerable Software and Affected Versions X-Cart versions prior to 5.1.11 Description The issue allows remote authenticated users to read or delete address data of arbitrary accounts. This can be achieved by sending a modified request to either update or remove address data...

X-Cart contains multiple vulnerabilities

Overview X-Cart versions 5.1.6 through 5.1.10 are vulnerable to cross-site scripting XSS, and versions 5.1.10 and below are vulnerable to authorization bypass. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2015-0950X-Cart versions 5.1...

PreProjects E-Smart Cart SQL Injection Vulnerability

PreProjects E-Smart Cart is an integrated shopping portal, search engine and email-based forum solution from PreProjects Australia. An SQL injection vulnerability exists in the embadmin/login.asp script in PreProjects E-Smart Cart, which arises from the program failing to adequately filter...

CS-Cart Cross-Site Request Forgery Vulnerability

CS-Cart is a PHP and MySQL based e-commerce software system developed by CS-Cart team. The system supports third-party software extensions, customized promotional strategies, product filtering definitions and more. A cross-site request forgery vulnerability exists in CS-Cart version 4.2.4. A remo...

CVE-2015-2701

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

CVE-2015-2701

CVE-2015-2701 describes a CSRF vulnerability in CS-Cart 4.2.4 where an attacker can hijack a user’s authenticated session by crafting a request to profiles-update/ that changes a password. The affected product is CS-Cart 4.2.4; the underlying issue is cross-site request forgery. No explicit fixes...

CVE-2015-2701

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

CVE-2015-2701: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

PT-2015-5842

Name of the Vulnerable Software and Affected Versions CS-Cart version 4.2.4 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that change a user's password via a request to "profiles-update/". Recommendations For version 4.2.4,...

YXcms1.2.7 刷账户预存款余额

简要描述： YXcms1.2.7 刷账户预存款余额 详细说明： 问题存在于protested/apps/member/controller/shopcarController.php 只判断了数目不能为负，但没有判断价格不能为负。 访问链接http://127.0.0.1/YXcmsApp1.2.7/index.php?r=member/shopcar/caradd post: 'code' = int 1 'name' = int 1 'price' = float -100 'num' = int 1 就向购物车里塞了一个负数价格的商品。 生成订单然后支付，就可以刷余额了。...

CS-Cart 4.2.4 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: CS-Cart 4.2.4 CSRF Google Dork: intext:"© 2004-2015 Simtech" Date: March 11, 2015 Exploit Author: Luis Santana Vendor Homepage: http://cs-cart.com Software Link:...

3d Cart Cross Site Scripting

Affected software: 3d cart Type of vulnerability: xss URL: http://3dcart.com/ Discovered by: Provensec Website: http://www.provensec.com Description: Hosted Shopping Cart Software to Build an Online Store Proof of concept /admin/usersview.asp?error=%3Cimg/src=%22x%3E%22onerror=...

CS-Cart 4.2.4 - Cross-Site Request Forgery

CS-Cart 4.2.4 - Cross-Site Request Forgery Exploit Title: CS-Cart 4.2.4 CSRF Google Dork: intext:"© 2004-2015 Simtech" Date: March 11, 2015 Exploit Author: Luis Santana Vendor Homepage: http://cs-cart.com Software Link:...

CS-Cart 4.2.4 - Cross-Site Request Forgery

Exploit Title: CS-Cart 4.2.4 CSRF Google Dork: intext:"© 2004-2015 Simtech" Date: March 11, 2015 Exploit Author: Luis Santana Vendor Homepage: http://cs-cart.com Software Link: https://www.cs-cart.com/index.php?dispatch=pages.gettrial&pageid=297&edition=ultimate Version: 4.2.4 Tested on: Linux +...