Zen-Cart Database Backup Disclosure

Zen-cart Database Backup Disclosure Vulnerability /+/ Exploit title : Zen-cart Database Backup Disclosure Vulnerability /+/ Script : Zen-cart /+/ Version : 1.5.1 /+/ Author : JoKeRStEx /+/ Date : 22/07/2013 /+/ Category : Webapps /+/ Google Dork : inurl:"/zcinstall/sql/" First You can Donwload...

PHPSHE电商程序SQL注入漏洞

简要描述： PHPSHE SQL注入3 详细说明： 在添加购物车时，存在过滤。 但是在更新购物车商品数量时，没有过滤，导致SQL注入。 在/module/index/order.php文件： //@ 购物车商品更改数量 @// case 'cartnum': $money'orderproductmoney' = $money'orderwlmoney' = $money'ordermoney' = 0; if pelogin'user' $result = $db-peupdate'cart', array'userid'=$suserid,...

Tiendas Online SQL Injection

Tiendas Online SQL Injection Vulnerability ============================================================================= Last login: Sat Sep 14 01:59:02 on console / / / / / / / / / / / / / : / / / / / / / / / / / / / / / | / / / / / / / / / / / / / // / // / / / / --X-- / / / / / / / / / /...

ecshop the goods_attr and goods_attr_id two secondary injection vulnerability detailed analysis-vulnerability warning-the black bar safety net

A: goodsattrid secondary injection ! 2 0 1 3 0 7 3 0 1 5 2 7 4 9 1 Injection use process: 1. Add items to your cart, write the injection code to product attribute id http://localhost/test/ecshop/flow.php?step=addtocart POST: goods="quick":1,"spec":"1 6 3","1 5 8'","goodsid":3...

PrestaShop 1.5.4 Cross Site Request Forgery

View online: http://demo-store.prestashop.com/en/ Advisory ID: PRESTASHOP Version: 1.5.4 Date: 2013-July-11 Security risk: Moderately critical 2 Exploitable from: Remote Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- With...

ecshop最新版本前台二次注入系列(2)

简要描述： 二次注入第二枚，这个点的注入内容至少进出数据库6次才最终到达了注入结果页面，当然全程可控。 详细说明： 先上注入结果图： SQL注入流程： 1.插入注入代码goodsattr至订单商品/wholesale.php可以插入,即商品批发页面，这里的goodsattr和 WooYun: ecshop最新版本前台二次注入系列1 里goodsattrid是不同的，之前的漏洞即正常在商品页面加入购物车是不能控制goodsattr的，当时goodsattr从数据库商品属性表读取。 2.将1生成的订单在用户中心订单查看页执行“放回购物车”操作。 3.查看购物车页面，注入代码执行 代码分析：...

PT-2013-3656

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2 Description A cross-site scripting XSS issue exists in the shopping-cart screen, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. Recommendations For versions...

CVE-2013-2312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

WordPress Simple Paypal Shopping Cart Plugin <= 3.5 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that change plugin settings. Solution Update the plugin...

CVE-2013-0118

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2013-0118

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2013-0118

CVE-2013-0118 affects CS-Cart prior to 3.0.6 where PayPal Standard Payments is configured. The vulnerability allows a remote attacker to change the payment recipient by sending a modified merchant email address, effectively setting the recipient to themselves. The NVD lists a base score of 5.0 (M...

CVE-2013-0118

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

PT-2013-2107

Name of the Vulnerable Software and Affected Versions CS-Cart versions prior to 3.0.6 Description The issue allows remote attackers to modify the payment recipient when PayPal Standard Payments is configured. This is achieved by altering the merchant's e-mail address, potentially allowing an...

CVE-2013-0118: Undefined Security Weakness

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CS-Cart v3.0.4 configured with PayPal Standard Payments design vulnerability

Overview CS-Cart v3.0.4 and possibly other versions configured with PayPal Standard Payment is susceptible to a client-side attack that results in an attacker purchasing items without having to pay for them. Description It has been reported that CS-Cart v3.0.4 configured with PayPal Standard...

Squirrelcart 3.5.4 Cross Site Scripting Vulnerability

Squirrelcart version 3.5.4 suffers from a reflective cross site scripting vulnerability. Squirrelcart v3.5.4 table Remote Cross-Site Scripting Vulnerability Vendor: Lighthouse Development Product web page: http://www.squirrelcart.com Affected version: v2.0.0 - 3.5.4 Summary: Squirrelcart PHP...

Squirrelcart 3.5.4 Cross Site Scripting

Squirrelcart v3.5.4 table Remote Cross-Site Scripting Vulnerability Vendor: Lighthouse Development Product web page: http://www.squirrelcart.com Affected version: v2.0.0 - 3.5.4 Summary: Squirrelcart PHP Shopping Cart software is a fully customizable, robust php shopping cart, designed with the...

Woven dream CMS vulnerability dedecms vulnerability 2013-02-10 SQL injection vulnerability-vulnerability warning-the black bar safety net

www.xxx.com/plus/search.php?keyword= In include/shopcar. class. php First take a look at this shopcar class is how to generate the cookie 2 3 9 function saveCookie$key,$value 2 4 0 2 4 1 ifisarray$value 2 4 2 2 4 3 $value = $this-enCrypt$this-enCode$value; 2 4 4 2 4 5 else 2 4 6 2 4 7 $value =...