Zen Cart Multiple Vulnerabilities (Feb 2014)

Zen Cart is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

phpmywind sql注入二

简要描述： 这套程序一个月前读过，发现了一些问题，厂商来注册了，就一并提交给厂商修复吧！希望厂商不要回复我说某创某宇已经联系过你们报告过该漏洞，我想说的是请尊重作者！ 详细说明： 这个漏洞我之前在t00ls发过（请不要怀疑我抄袭），因为当时厂商没来乌云，现在厂商终于来了，就提交一下，希望尽快修补。 之前提交的注射一需要登录，这个地方不需要登录 shoppingcart.php //初始化参数 $a = isset$a ? $a : ''; //添加购物车 if$a == 'addshopingcart' //构成选中属性 ifisset$typeid//同样未做过滤 //获取商品属性...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CVE-2013-7317

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CVE-2013-7317

CVE-2013-7317 affects CS-Cart prior to 4.1.1 and involves cross-site scripting (XSS) via the vulnerable parameters settings_file and data_file to the SWF files ampie.swf, amline.swf, or amcolumn.swf. The issue allows remote attackers to inject arbitrary script/HTML in the context of the user’s br...

CVE-2013-7317

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CVE-2013-7317: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

PT-2014-3359

Name of the Vulnerable Software and Affected Versions CS-Cart versions prior to 4.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the settings file or data file parameters to specific API endpoints, such as a "ampie.swf", b...

UAEPD Shopping Script SQL Injection Vulnerabilty

Exploit for php platform in category web applications .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.uaepd.net/ .:. Dork : 1inurl:”products.php?catid=” “Powered by: PD ” 2inurl:”products.php?pid” “Power...

CS-Cart version 4.0.2 contains cross-site scripting vulnerabilities

Overview CS-Cart version 4.0.2 and possibly earlier versions contain cross-site scripting XSS vulnerabilities CWE-79. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CS-Cart version 4.0.2 and possibly earlier versions contain cross-site...

CVE-2014-1618

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

Sql injection

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

CVE-2014-1618

CVE-2014-1618 affects the UAEPD Shopping Cart Script with multiple SQL injection vulnerabilities. The vulnerability allows remote attackers to execute arbitrary SQL commands through the following parameters: cat_id or p_id in products.php, and id in page.php or news.php. The cvss base score is 7....

CVE-2014-1618

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

CVE-2014-1618: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

Joomla QuickSell File Seller Plugin - Multiple XSS

Latest QuickSell Joomla Plugin suffers on multiple Cross Site Scripting vulnerabilities because of poor variables filtering. Title: Joomla - QuickSell File Seller Plugin - Multiple XSS Date: 01.19.14 Version: 3.3.2 Latest ATM Demo: demo.shopfiles.com...

UAEPD Shopping Script SQL Injection

uaepd script – Multiple Sql Injection Vulnerabilty ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.uaepd.net/ .:. Dork :...

UAEPD Shopping Script - news.php?id SQL Injection

UAEPD Shopping Script - news.php?id SQL Injection source: https://www.securityfocus.com/bid/64734/info UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can explo...

UAEPD Shopping Script - 'products.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/64734/info UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating the SQL query logi...

Zen Cart <= 1.5.1 Information Disclosure Vulnerability

Zen Cart is prone to an information disclosure vulnerability. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...