CVE-2006-6691

Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to 1 admin/include/common.php, 2 include/common.php, or 3 commoninclude/common.php...

CVE-2006-6691

Valdersoft Shopping Cart 3.0 and earlier are affected by multiple PHP remote file inclusion vulnerabilities. The issue arises from remote attackers being able to include files via a URL supplied in the commonIncludePath parameter to admin/include/common.php, include/common.php, or common_include/...

Valdersoft Shopping Cart v3.0 (E-Commerce Software)*****[ commonIncludePath ] Remote File Include

Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include $commonIncludePath."common.php" ; + + Exploit :...

Valdersoft Shopping Cart v3.0 (E-Commerce Software)*****[ commonIncludePath ] Remote File Include

Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include $commonIncludePath."common.php" ; + + Exploit :...

Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions

Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +cod...

Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions

Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include $commonIncludePath."common.php" ; + + Exploit :...

Valdersoft Shopping Cart 3.0 Multiple Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ========================================================================= Valdersoft Shopping Cart 3.0 Multiple Remote File Include Vulnerabilities ========================================================================= Valdersoft Shoppi...

shopsite-xss.txt

Hackers Center Security Group http://www.hackerscenter.com/ Doz's Security Advisory Desc: ShopSite Shopping Cart Multiple XSS Risk: Medium ShopSite™ is the easiest-to-use shopping cart software for small to medium-sized businesses. ShopSite ecommerce shopping cart is one of the most user-friendly...

CVE-2006-6464

viewcart in Midicart accepts negative numbers in the Qty quantity field, which allows remote attackers to obtain a smaller total price for a shopping cart...

CVE-2006-6464

Summary: CVE-2006-6464 relates to Midicart’s viewcart where the Qty field accepts negative numbers, allowing manipulation of the cart total to be smaller. The PT-2006-7073 entry confirms the vulnerability in Midicart (no affected versions specified) and states there is no information about a fix ...

Zen Cart多个SQL注入漏洞

Zen Cart是一款基于PHP的新闻管理程序。 Zen Cart不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Zen Cart Web Shopping Cart 1.3 Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.1.2 d...

PT-2006-7073 · Midicart · Midicart

Name of the Vulnerable Software and Affected Versions: Midicart affected versions not specified Description: The issue allows remote attackers to manipulate the total price of a shopping cart by entering negative numbers in the Qty field of the viewcart function in Midicart. Recommendations: At t...

QualiteamXCart远程命令执行漏洞

X-Cart是一款基于PHP的电子商务程序。X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart3.4.3 厂商补丁：Qualiteam --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.x-cart.com/...

ECWShopindex.php远程SQL注入漏洞 Exploit

No description provided by source. 跨站脚本： http://www.victim.com/index.php?c=srch&ctg=Cat1&id=754ce025144839c2abe369c36d90d8e9&key=1&comp=1&min=1&max=scriptvar%20xss=31337;alertxss;/script 信息泄漏和可能的SQL注入:...

CVE-2006-6206

SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter...

CVE-2006-6207

SQL injection vulnerability in products.asp in Evolve shopping cart aka Evolve Merchant allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error...

CVE-2006-6207

The CVE-2006-6207 issue affects the Evolve shopping cart (aka Evolve Merchant) where the products.asp page processes the partno parameter. The root cause is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands on the backend database. Reported impact is cap...

CVE-2006-6207

SQL injection vulnerability in products.asp in Evolve shopping cart aka Evolve Merchant allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error...

CVE-2006-6206

CVE-2006-6206 affects WarHound General Shopping Cart, where an SQL injection vulnerability exists in item.asp via the ItemID parameter. The underlying issue allows remote attackers to execute arbitrary SQL commands. Documentation provides no explicit patch/version or mitigation steps; exploitatio...

CVE-2006-6209

Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 id2006quant parameter to a itemshow.asp, or the 2 maingroup or 3 secondgroup parameter to b itemlist.asp. NOTE: the codeno parameter t...