Information disclosure

The Cart App aka com.virtecha.mobilewallet application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6779

CVE-2014-6779 affects the Cart App (com.virtecha.mobilewallet) for Android version 1.5. The connected documents confirm that the app does not verify X.509 certificates when establishing SSL connections, which enables man-in-the-middle attackers to spoof servers and obtain sensitive information vi...

PT-2014-7457

Name of the Vulnerable Software and Affected Versions The Cart App aka com.virtecha.mobilewallet version 1.5 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

Cart Engine 3.0 - Multiple Vulnerabilities

No description provided by source. === Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTT...

CVE-2014-6779: Undefined Security Weakness

The Cart App aka com.virtecha.mobilewallet application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Comersus Sophisticated Cart Database Disclosure

!/usr/bin/perl -w Comersus Sophisticated Cart Database Disclosure Exploit Author : indoushka Vondor : http://www.comersus.com use LWP::Simple; use LWP::UserAgent; system'cls'; system'Comersus Sophisticated Cart Database Disclosure Exploit '; system'color a'; if@ARGV new; my $request =...

Cart Engine Multiple Vulnerabilities

Cart Engine is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cart Engine 3.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications === Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a...

Cart Engine 3.0 - Multiple Vulnerabilities

=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...

Cart Engine 3.0 - Multiple Vulnerabilities

Cart Engine 3.0 - Multiple Vulnerabilities === Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially...

Zen Cart 1.5.3 - Multiple Vulnerabilities

No description provided by source. Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

Cart Engine 3.0 XSS / Open Redirect / SQL Injection

=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...

SA-CONTRIB-2014-085 - Ubercart - Information disclosure

The Ubercart module for Drupal provides a shopping cart and e-commerce features for Drupal. The per-user order history view is not properly protected. This vulnerability is mitigated by the fact that an attacker must have an account with the "view own orders" permission and can only view order ID...

Zen Cart 1.5.3 - Multiple Vulnerabilities

Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id. localhost/zen/zen-cart-v1.5.3-07042014/admin123/profiles.php?action=delete&profile=2 - Reset layou...

Webasyst Shop Script 5.2.2.30933 Cross Site Scripting

Exploit Title:webasyst shop script stored xss Date: 8/12/2014 Exploit Author: Ankit Bharathan Description: shop-Script 5 Emerging PHP ecommerce framework that helps you increase sales.Feature-rich PHP shopping cart solution & ecommerce framework developed in 2013--2014. One of the leading shoppin...

CS-Cart 4.2.0 Session Hijacking Vulnerability

CS-Cart version 4.2.0 suffers from a session hijacking vulnerability due to weakly minted session identifiers. Vendor: CS-Cart Homepage: https://www.cs-cart.com Fixed in: v4.2.1 Released: July 22nd 2014 CS-Cart is 127MB of shitty PHP and HTML code that is supposed to function as a secure e-commer...

CS-Cart 4.2.0 Session Hijacking

Vendor: CS-Cart Homepage: https://www.cs-cart.com Fixed in: v4.2.1 Released: July 22nd 2014 CS-Cart is 127MB of shitty PHP and HTML code that is supposed to function as a secure e-commerce site. It is developed by people who don't reply to emails but who covertly patch bugs reported to them and...

TheCartPress 1.1.1 - Remote File Inclusion

The TheCartPress eCommerce Shopping Cart WordPress plugin was affected by a Remote File Inclusion security vulnerability...

Shopping Cart 8.1.14 - Shell Upload, SQL Injection

The levelfourstorefront WordPress plugin was affected by a Shell Upload, SQL Injection security vulnerability...

Simple Paypal Shopping Cart <= 3.5 - Cross-Site Request Forgery (CSRF)

The WordPress Simple PayPal Shopping Cart WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...