CVE-2006-4214

Zen Cart 1.3.0.2 and earlier contains multiple SQL injection vulnerabilities. The flaws are exploitable via: (1) GPC data to ipn_get_stored_session in ipn_main_handler.php (can modify $_SESSION), (2) session id in a cookie to whos_online_session_recreate, (3) quantity in add_cart, (4) id[] when a...

Zen Cart autoload_func.php autoLoadConfig Array Remote File Inclusion

The version of Zen Cart installed on the remote host fails to sanitize input to the 'autoLoadConfig' array parameter before using it in 'includes/autoloadfunc.php' to include PHP code. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able to exploit these...

Zen Cart ipn_main_handler.php custom SQL Injection

The version of Zen Cart installed on the remote host fails to properly sanitize input to the 'custom' parameter of the 'ipnmainhandler.php' script before using it in a database query. Provided PHP's 'magicquotesgpc' setting is disabled, an unauthenticated attacker may be able to exploit this issu...

[SA21484] Zen Cart SQL Injection and File Inclusion Vulnerabilities

---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation...

Zen Cart Web Shopping Cart 1.3.0.2 - autoload_func.php?autoLoadConfig[999][0][loadFile] Remote File Inclusion

Zen Cart Web Shopping Cart 1.3.0.2 - autoloadfunc.php?autoLoadConfig9990loadFile Remote File Inclusion source: https://www.securityfocus.com/bid/19543/info Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An...

Zen Cart Web Shopping Cart 1.3.0.2 - 'autoload_func.php?autoLoadConfig[999][0][loadFile]' Remote File Inclusion

source: https://www.securityfocus.com/bid/19543/info Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote and local files containing malicious PHP cod...

Comersus ASP shopping cart <= DataBase Downloading vuln

ComerSus ASP Shopping Cart Vendor : Www.Compersus.Com Credits : MFox HomePage : Www.HackerZ.ir Remote DataBase Getting ! Proof of Concept : Http://Target/Path/database/comersus.mdb...

CVE-2006-3794

SQL injection vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the search field. NOTE: the vendor has disputed this issue, stating "if someone were to type in any sql injection code, that code would never be queried...

CVE-2006-3800

Cross-site scripting XSS vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the "new review" text box...

AFCommerce Shopping Cart

The 'Demo Store' version of the AFCommerce Shopping Cart www.afcommerce.com is vulnerable to both SQL Injection and Cross Site Scripting XSS. SQL Injection can be tested by inserting the classic 'or 1=1-- into the search field. The result is that the first record is returned. We can also perform ...

CVE-2006-3800

Cross-site scripting XSS vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the "new review" text box...

CVE-2006-3794

CVE-2006-3794 describes a SQL injection vulnerability in the Amazing Flash AFCommerce Shopping Cart. The flaw allows remote attackers to execute arbitrary SQL commands via the search field, potentially enabling data access/manipulation. The affected component is the AFCommerce Shopping Cart searc...

CVE-2006-3800

CVE-2006-3800 describes a cross-site scripting (XSS) vulnerability in the Amazing Flash AFCommerce Shopping Cart. The issue allows remote attackers to inject arbitrary web script or HTML via the “new review” text box. Documents do not specify affected versions, root cause details beyond the input...

CVE-2006-3757

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...

CVE-2006-3757

CVE-2006-3757 affects Zen Cart 1.3.0.2. The vulnerability in index.php allows remote attackers to obtain sensitive information by passing empty (GET, SESSION, POST, COOKIE, SESSION) parameters, causing an error message that reveals the installation path. The description notes this may stem from a...

CVE-2006-3757

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...

PT-2006-4654 · Amazing Flash · Amazing Flash Afcommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Amazing Flash AFCommerce Shopping Cart affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands via the search field, potentially leading to unauthorized access or data manipulation...

CVE-2006-3542

Multiple cross-site scripting XSS vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 shop name field in a editshop.php, b edititem.php, and c index.php; and via the 2 item field in editshop.php and edititem.php...

CVE-2006-3542

Multiple cross-site scripting XSS vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 shop name field in a editshop.php, b edititem.php, and c index.php; and via the 2 item field in editshop.php and edititem.php...

CVE-2006-3542

CVE-2006-3542 affects Garry Glendown Shopping Cart 0.9. The vulnerabilities are multiple cross-site scripting (XSS) flaws that allow an attacker to inject arbitrary web script or HTML via the shop name field in the pages editshop.php, edititem.php, and index.php, and via the item field in editsho...