CVE-2006-6464

Summary: CVE-2006-6464 relates to Midicart’s viewcart where the Qty field accepts negative numbers, allowing manipulation of the cart total to be smaller. The PT-2006-7073 entry confirms the vulnerability in Midicart (no affected versions specified) and states there is no information about a fix ...

CVE-2006-6464

viewcart in Midicart accepts negative numbers in the Qty quantity field, which allows remote attackers to obtain a smaller total price for a shopping cart...

Zen Cart多个SQL注入漏洞

Zen Cart是一款基于PHP的新闻管理程序。 Zen Cart不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Zen Cart Web Shopping Cart 1.3 Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.1.2 d...

PT-2006-7073 · Midicart · Midicart

Name of the Vulnerable Software and Affected Versions: Midicart affected versions not specified Description: The issue allows remote attackers to manipulate the total price of a shopping cart by entering negative numbers in the Qty field of the viewcart function in Midicart. Recommendations: At t...

QualiteamXCart远程命令执行漏洞

X-Cart是一款基于PHP的电子商务程序。X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart3.4.3 厂商补丁：Qualiteam --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.x-cart.com/...

ECWShopindex.php远程SQL注入漏洞 Exploit

No description provided by source. 跨站脚本： http://www.victim.com/index.php?c=srch&ctg=Cat1&id=754ce025144839c2abe369c36d90d8e9&key=1&comp=1&min=1&max=scriptvar%20xss=31337;alertxss;/script 信息泄漏和可能的SQL注入:...

CVE-2006-6206

SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter...

CVE-2006-6207

SQL injection vulnerability in products.asp in Evolve shopping cart aka Evolve Merchant allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error...

CVE-2006-6206

SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter...

CVE-2006-6206

CVE-2006-6206 affects WarHound General Shopping Cart, where an SQL injection vulnerability exists in item.asp via the ItemID parameter. The underlying issue allows remote attackers to execute arbitrary SQL commands. Documentation provides no explicit patch/version or mitigation steps; exploitatio...

CVE-2006-6209

CVE-2006-6209 concerns multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart. The affected components allow remote attackers to inject arbitrary SQL via the following parameters: (1) id2006quant to item_show.asp, and (2) maingroup or (3) secondgroup to it...

CVE-2006-6207

The CVE-2006-6207 issue affects the Evolve shopping cart (aka Evolve Merchant) where the products.asp page processes the partno parameter. The root cause is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands on the backend database. Reported impact is cap...

CVE-2006-6207

SQL injection vulnerability in products.asp in Evolve shopping cart aka Evolve Merchant allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error...

CVE-2006-6209

Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 id2006quant parameter to a itemshow.asp, or the 2 maingroup or 3 secondgroup parameter to b itemlist.asp. NOTE: the codeno parameter t...

CVE-2006-6207: Undefined Security Weakness

SQL injection vulnerability in products.asp in Evolve shopping cart aka Evolve Merchant allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error...

PT-2006-6837 · Evolve · Evolve Shopping Cart

Name of the Vulnerable Software and Affected Versions: Evolve shopping cart affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands via the partno parameter in the "products.asp" page. This enables attackers to manipulate the database. The...

CVE-2006-6209: Undefined Security Weakness

Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 id2006quant parameter to a itemshow.asp, or the 2 maingroup or 3 secondgroup parameter to b itemlist.asp. NOTE: the codeno parameter t...

CVE-2006-6206: Undefined Security Weakness

SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter...

aria-evolve.txt

Aria-Security Team Advisory ----------------------------------------------------------- Software: Evolve shopping cart Method: SQL Injection PoC: http://target/path/products.asp?partno=SQL INJECTION Contact: [email protected]...

aria-general.txt

Aria-Security Team Advisory ----------------------------------------------------------- Software: General Shopping Cart Method: SQL Injection Vendor:http://warhound.com PoC: http://target/item.asp?ItemID=SQL Injection Contact: [email protected]...