CVE-2005-1501

MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to 1 searchlist.php, 2 itemlist.php, or 3 itemshow.php, which reveal the path in a PHP error message...

CVE-2005-1502

The CVE-2005-1502 entry describes a cross-site scripting (XSS) vulnerability in MidiCart PHP Shopping Cart. The affected components are the search_list.php script (parameter: searchstring) and item_list.php (parameters: secondgroup, maingroup). The core issue is the ability for remote attackers t...

CVE-2005-1501

Vulnerability summary for CVE-2005-1501: MidiCart PHP Shopping Cart allows remote attackers to disclose sensitive information by directly requesting one of three PHP pages (search_list.php, item_list.php, item_show.php). The root cause is that these requests reveal the path in a PHP error message...

CVE-2005-1503

CVE-2005-1503 affects MidiCart PHP Shopping Cart. The issue comprises multiple SQL injection vulnerabilities exploitable via parameters in search_list.php (searchstring), item_list.php (maingroup, secondgroup), and item_show.php (code_no). Successful exploitation allows remote execution of arbitr...

CVE-2005-1501

MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to 1 searchlist.php, 2 itemlist.php, or 3 itemshow.php, which reveal the path in a PHP error message...

PT-2005-2567 · Quick.Cart · Quick.Cart

Name of the Vulnerable Software and Affected Versions: Quick.cart version 0.3.0 Description: The issue concerns a potential SQL injection vulnerability in the index.php file of Quick.cart, allegedly allowing remote attackers to execute arbitrary SQL commands via the iCategory parameter. However,...

CVE-2004-2024

The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via passwordforgotten.php...

CVE-2004-2023

The vulnerability CVE-2004-2023 affects Zen Cart (notably Zen Cart 1.1.2d and 1.1.4 before patch 1). The issue is a SQL injection in login.php that allows remote attackers to modify or disclose data via the (1) admin_name or (2) admin_pass parameters. The underlying cause is unsafely constructed ...

CVE-2004-1873

The CVE-2004-1873 entry concerns SQL injection in category.asp of A-CART Pro 2.0 and A-CART 2.0. The root cause is improper handling of the catcode parameter in category.asp, enabling remote attackers to gain privileges. Connected PT-2004-2772 provides concrete remediation guidance: update the ca...

CVE-2004-1873

SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to gain privileges via the catcode parameter...

CVE-2004-1874

CVE-2004-1874 describes multiple XSS vulnerabilities in A-CART Pro and A-CART 2.0, specifically in the vulnerable components deliver.asp and billing.asp, allowing remote attackers to inject arbitrary web script or HTML via the user information forms. Connected documents confirm the affected produ...

CVE-2004-2024

Zen Cart 1.1.4 prior to patch 2 contains debugging code in the Admin password retrieval path (password_forgotten.php) that can enable attackers to gain administrative privileges. The connected records confirm the product/version and the root cause as debugging code in the admin password recovery ...

CVE-2004-2025

Zen Cart 1.1.3 is affected by a SQL injection in application_top.php (before patch 2) that can be exploited via the products_id parameter to execute arbitrary SQL on the backend. The vulnerability is remote, with impact on confidentiality/integrity/availability as stated, allowing attackers to ru...

CVE-2004-1874

Multiple cross-site scripting XSS vulnerabilities in 1 deliver.asp and 2 billing.asp in A-CART Pro and A-CART 2.0 allow remote attackers to inject arbitrary web script or HTML via the user information forms...

CVE-2004-2025

SQL injection vulnerability in applicationtop.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2004-2023

SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the 1 adminname or 2 adminpass parameters...

[hackgen-2005-#004] - Multiple bugs in MidiCart PHP Shopping Cart

http://www.hackgen.org/advisories/hackgen-2005-004.txt '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' hackgen-2005-004 ' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' Multiple bugs in MidiCart PHP Shopping Cart '...

CVE-2005-0907

Multiple SQL injection vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to category.php, 2 the id parameter to item.php, 3 the lang parameter to index.php, 4 the searchQuery parameter to searchresult.php, 5 or the...

CVE-2005-1010

Cross-site scripting XSS vulnerability in Comersus Cart 6 allows remote attackers to inject arbitrary web script or HTML via the account username...

CVE-2005-1289

index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 art and possibly 2 cat parameters...