QuadComm Q-Shop 2.5 - Failure To Validate Credentials

QuadComm Q-Shop 2.5 - Failure To Validate Credentials source: https://www.securityfocus.com/bid/8153/info Zone-H has reported that the Q-Shop ASP shopping cart software contains a vulnerability that may allow remote attackers to upload arbitrary files. Once uploaded, the attacker may be able to...

PDGSoft Shopping Cart Multiple Vulnerabilities

The executables 'redirect.exe' and/or 'changepw.exe' exist on this web server. Some versions of these files are vulnerable to remote exploit. An attacker can use this hole to gain access to confidential data or escalate their privileges on the web server. As Nessus solely relied on the existence ...

StockMan Shopping Cart shop.plx Path Disclosure

The remote host is running the StockMan shopping cart. There is a flaw in this version that could allow an attacker to obtain the physical path to the remote web root by requesting a non-exisant page through the 'shop.plx' CGI. An attacker may use this flaw to gain more knowledge about the setup...

StockMan Shopping Cart shop.plx page Parameter Arbitrary Command Execution

The remote host is running the StockMan shopping cart. According to the version number of the CGI shop.plx, there is a flaw in this installation that could allow an attacker to execute arbitrary commands on this host, and which could also allow him to obtain your list of customers or their credit...

Stockman Shopping Cart 7.8 - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/7485/info Stockman Shopping Cart has been reported prone to a remote command execution vulnerability. This issue presents itself in the 'shop.plx' script. The problem results from a lack of sufficient sanitization performed on user supplied URI parameters...

Stockman Shopping Cart 7.8 - Arbitrary Command Execution

Stockman Shopping Cart 7.8 - Arbitrary Command Execution source: https://www.securityfocus.com/bid/7485/info Stockman Shopping Cart has been reported prone to a remote command execution vulnerability. This issue presents itself in the 'shop.plx' script. The problem results from a lack of sufficie...

Multiple vulnerabilities in AutomatedShops WebC shopping cart

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Vulnerability Advisory Product: WebC shopping cart Versions: 2.011 - 5.005 Vulnerable to all exploits 5.010 vulnerable to local exploit Vendor: Automated Shops http://www.automatedshops.com Platforms: Linux/FreeBSD/Win32 Impact: Remote code...

AutomatedShops webc.cgi Installation Detection

The remote host is running webc.cgi, a shopping cart application. By default, webc.cgi sends some information to every user, including its version number, serial number and company name. This script extracts this information and displays it to the user. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2002-2302

3D3.Com ShopFactory 5.5 through 5.8 allows remote attackers to modify the prices in their shopping carts by modifying the price in a hidden form field...

CVE-2002-2303

3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data...

ShopFactory shopping cart price manipulation

Trust Factory Security Advisory TF20021004 Discovery Date: October 4, 2002 Release Date: December 2, 2002 ID: TF20021004 Title: ShopFactory shopping cart price manipulation Impact: Customers can modify the price of items at will Affected Technology: Online shopping carts created with ShopFactory...

wp-02-0012: Carello 1.3 Remote File Execution

Westpoint Security Advisory Title: Carello 1.3 Remote File Execution Risk Rating: Medium Software: Carello Shopping Cart Platforms: Win2k, WinNT Vendor URL: www.carelloweb.com Author: Matt Moore [email protected] Date: 10th July 2002 Advisory ID: wp-02-0012 Overview: ========= Carello 1.3 is ...

[UNIX] SunShop Shopping Cart Security Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...

SunSop: cross-site-scripting bug

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following cross-site-scripting bug in SunShop Shopping Cart: Details - ------- Product: SunShop Shopping Cart Version: 2.5 and maybe all versions before OS affected: all OS with php and mysql Vendor-URL:...

CVE-2001-0992

shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter...

CVE-2001-0985

Affected product: Hassan Consulting Shopping Cart 1.23. Vulnerability: arbitrary command execution via shell metacharacters in the URL parameter “page” leading to remote code execution. Root cause is unsafely handling the page parameter in shop.pl, allowing user-supplied input to be interpreted b...

CVE-2001-0985

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter...

CVE-2001-0992

ShopPlus CGI (shopplus.cgi) in the ShopPlus shopping cart is vulnerable to remote arbitrary command execution via shell metacharacters in the file parameter. The issue allows execution with the web server’s privileges, with CVSS base score 7.5 (HIGH) and network attack vector with no authenticati...

VERISIGN "PAYFLOW LINK" PAYMENT SERVICE SECURITY FAILURE

VERISIGN PAYFLOW PAYMENT SERVICE SECURITY FAILURE PAYFLOW LINK SERVICE DESCRIPTION: The final checkout page of various online shopping cart applications presents the shopper with a form asking for credit card acct, exp date, etc. When the shopper submits the form, the data is sent directly to the...

Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting

Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting source: https://www.securityfocus.com/bid/3714/info Aktivate is a shopping cart system which is geared towards Unix and Linux users, uses MySQL as a backend, and is written in Perl. Aktivate is prone to cross-site scripting attacks. It is possib...