CVE-2009-3215

The CVE-2009-3215 entry describes an SQL injection in IXXO Cart Standalone prior to 3.9.6.1 and the IXXO Cart Joomla! 1.0.x component. The root cause is unsafely handling the parent parameter, enabling remote attackers to execute arbitrary SQL commands. Affected software includes IXXO Cart Standa...

CVE-2009-3215: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter...

Zen Cart record_company.php模块远程代码执行漏洞

BugCVE: CVE-2009-2255 BUGTRAQ: 35467 Zen Cart没有对admin/recordcompany.php模块强制管理认证，远程攻击者可以通过recordcompanyimage和 PATHINFO参数上传.php文件，并通过直接请求images/中的文件来访问上传的文件，导致执行任意指令。 Zen Cart 1.3.8 厂商补丁： Zen Ventures ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.zen-cart.com/forum/showthread.php?t=1301...

Zen Cart admin/sqlpatch.php模块SQL注入漏洞

BugCVE: CVE-2009-2254 BUGTRAQ: 35468 Zen Cart没有对admin/sqlpatch.php模块强制管理认证，这允许远程攻击者在请求中通过querystring和PATHINFO参数执行SQL注入攻击。 Zen Cart 1.3.8 厂商补丁： Zen Ventures ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.zen-cart.com/forum/showthread.php?t=130161 !/usr/bin/python ------- Zen Cart 1.3.8...

Qualiteam X-Cart远程命令执行漏洞

BUGTRAQ: 9560 X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。 问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart 3.4.11 Qualiteam X-Cart 3.4.3 Qualiteam X-Cart 3.4 .0 Qualiteam X-Cart 3.3.2 Qualiteam X-Cart 3.3 .0 Qualiteam X-Cart 3.2.1 Qualite...

Qualiteam X-Cart多个远程信息泄露漏洞

BUGTRAQ: 9563 X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限查看任意文件内容或获得敏感信息。 'customer/auth.php'脚本对'shopclosedfile'参数缺少充分过滤，攻击者提交包含多个'../'字符的参数，可绕过WEB ROOT限制，以WEB进程权限查看任意文件内容。 另外'admin/general.php'脚本对'mode'参数也缺少充分限制，提交特殊参数可获得PHP和PERL程序的详细信息。 X-Cart 3.4.3 厂商补丁： Qualiteam ---------...

Paypal Shopping Cart Script - index.php?cid SQL Injection

Paypal Shopping Cart Script - index.php?cid SQL Injection source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data...

Paypal Shopping Cart Script - index.php Multiple Cross-Site Scripting Vulnerabilities

Paypal Shopping Cart Script - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently...

Paypal Shopping Cart Script - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal...

Paypal Shopping Cart Script - 'index.php?cid' SQL Injection

source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal...

CVE-2008-6986

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...

CVE-2008-6985

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

Sql injection

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

Sql injection

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...

CVE-2008-6985

Zen Cart vulnerability CVE-2008-6985 affects the shopping_cart.php component (includes/classes/shopping_cart.php) in versions 1.2.0 through 1.3.8a, where SQL injection is possible via the id parameter during add or update cart operations when magic_quotes_gpc is disabled. The connected NVD entry ...

CVE-2008-6986

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...

CVE-2008-6986

Zen Cart 1.3.0–1.3.8a is affected by CVE-2008-6986 due to an SQL injection in actionMultipleAddProduct in includes/classes/shopping_cart.php. When magic_quotes_gpc is disabled, the products_id[] array used by multiple_products_add_product can lead remote attackers to execute arbitrary SQL command...

CVE-2008-6985

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

CVE-2008-6985: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

CVE-2008-6986: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...