Shopping Cart V0.9

Shopping Cart V0.9 Homepage: http://glendown.de/shop/ Affected files: index.php editshop.php edititem.php ----------------------------------------- XSS vuln on editshop.php & edititem.php: Data isn't sanatized before being entered. For a PoC as a shop name or item enter in: scriptalert'xss'/scrip...

Zen-Cart 1.3.0.2 Full Path Disclosure

Zen-Cart 1.3.0.2 En: Zen-Cart .. E-commerce PHP Program - This Bug Can Tell U Where The Program @ Server Ar: .. Full Path Disclosure :- /index.php?GET= /index.php?SESSION= /index.php?POST= /index.php?COOKIE= /index.php?SESSION= /------------------------------------------/...

CVE-2006-3030

Multiple cross-site scripting XSS vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ToCategory and 2 FromCategory parameters to a ProductDetailsForm.asp and 3 UserName and 4 Password parameters to b...

CVE-2006-3030

Multiple cross-site scripting XSS vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ToCategory and 2 FromCategory parameters to a ProductDetailsForm.asp and 3 UserName and 4 Password parameters to b...

CVE-2006-3030

DwZone Shopping Cart prior to or at version 1.1.9 has multiple XSS vulnerabilities. The issue arises in the web app’s handling of user input parameters: (1) ToCategory and (2) FromCategory to ProductDetailsForm.asp, and (3) UserName and (4) Password to LogIn/VerifyUserLog.asp. The flaws allow rem...

Improper access control

A-CART 2.0 stores the acart20.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain username and password information...

CVE-2006-2948

A-CART 2.0 stores the acart20.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain username and password information...

CVE-2006-2948

Technical details about CVE-2006-2948 are not provided in the connected documents; only the generic description is available. Monitor for updates from official advisories.

CVE-2006-2948

A-CART 2.0 stores the acart20.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain username and password information...

Remote file inclusion

PHP remote file inclusion vulnerability in class.csphpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the classesdir parameter...

CVE-2006-2863

PHP remote file inclusion vulnerability in class.csphpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the classesdir parameter...

CVE-2006-2863

PHP remote file inclusion vulnerability in class.csphpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the classesdir parameter...

CVE-2006-2863

CVE-2006-2863 affects CS-Cart 1.3.3 via a PHP remote file inclusion in class.cs_phpmailer.php, exploitable through the classes_dir parameter to execute arbitrary PHP code. The NVD entry notes a Network attack vector with authentication not required and partial confidentiality/integrity/availabili...

CVE-2006-2827

SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN." NOTE: the vend...

Sql injection

DISPUTED SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN." NOTE:...

CVE-2006-2827

SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN." NOTE: the vend...

CVE-2006-2827

SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN." NOTE: the vend...

CVE-2006-2827

CVE-2006-2827 affects X-Cart Gold/Pro versions 4.0.18 through 4.1.0 beta 1. The vulnerability is an SQL injection in search.php triggered by the "Search for pattern" field when settings are limited to only "Search in Detailed description" and "Search also in ISBN." The vendor disputed the issue, ...

PT-2006-3745 · X Cart · X-Cart

Name of the Vulnerable Software and Affected Versions: X-Cart Gold and Pro versions 4.0.18 through 4.1.0 beta 1 Description: The issue allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field in search.php, when the settings specify only "Search in Detailed...

adv32-K-159-2006.txt

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV32$2006 --------------------------------------------------------------------------- ECHOADV32$2006 SCart 2.0 Remote Code Execution ---------------------------------------------------------------------------...