PicturesPro Photo Cart AdminPrint.PHP远程文件包含漏洞

PicturesPro Photo Cart是一款基于php的WEB应用程序。 PicturesPro Photo Cart不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'AdminPrint.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 PICTURESPRO Photo Cart 3.9 目前没有解决方案提供： http://www.picturespro.com/...

Evolve Shopping Cart - 'products.asp' SQL Injection

source: https://www.securityfocus.com/bid/21323/info Evolve Shopping Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application,...

Evolve Shopping Cart - products.asp SQL Injection

Evolve Shopping Cart - products.asp SQL Injection source: https://www.securityfocus.com/bid/21323/info Evolve Shopping Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could...

[Aria-Security Team] General Shopping Cart SQL Injection Vulnerability

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian ----------------------------------------------------------- Software: General Shopping Cart Method: SQL Injection Vendor:http://warhound.com PoC: http://target/item.asp?ItemID=SQL Injection Contact:...

[Aria-Security Team] Evolve shopping cart SQL Injection Vulnerability

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian ----------------------------------------------------------- Software: Evolve shopping cart Method: SQL Injection PoC: http://target/path/products.asp?partno=SQL INJECTION Contact:...

CVE-2006-6111

Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 productid parameter in product.asp or 2 search parameter in search.asp. NOTE: the category.asp vector is already covered by CVE-2004-1873...

CVE-2006-6111

Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 productid parameter in product.asp or 2 search parameter in search.asp. NOTE: the category.asp vector is already covered by CVE-2004-1873...

CVE-2006-6111

CVE-2006-6111 covers multiple SQL injection flaws in Alan Ward A-CART Pro 2.0: remote SQL commands via productid in product.asp or via search in search.asp. The category.asp vector is addressed by CVE-2004-1873 (SQLi via catcode). Connected sources confirm a separate legacy issue (CVE-2004-1873) ...

CVE-2006-6111: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 productid parameter in product.asp or 2 search parameter in search.asp. NOTE: the category.asp vector is already covered by CVE-2004-1873...

[Aria-Security Team] MidiCart ASP Shopping Cart SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://www.aria-security.com/forum/showthread.php?t=42 ----------------------------------------------------------- Software: MidiCart ASP Shopping Cart Method: SQL Injection And Cro...

[Aria-Security Team] MidiCart ASP Plus Shopping Cart SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian ----------------------------------------------------------- Software: MidiCart ASP Plus Shopping Cart Method: SQL Injection And Cross Site Scripting PoC: http://target/path/itemshow.asp?codeno=SQL...

CVE-2006-6093

Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attackers to execute arbitrary PHP code via a URL in the 1 adminfolder and 2 path parameters...

CVE-2006-6093

CVE-2006-6093 affects PicturesPro Photo Cart 3.9. The flaw is in adminprint.php where remote PHP code execution is possible via a URL in the (1) admin_folder and (2) path parameters, exploiting PHP remote file inclusion. CVSS v2 base score 7.5 (HIGH) driven by network access, low attack complexit...

CVE-2006-6073

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 ProductID parameter in productdetail.asp or the 2 categoryid parameter in products.asp...

CVE-2006-6074

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via 1 the ProductID parameter in a reviews.asp, or the 2 catid or 3 subid parameter in b subProducts.asp. NOTE: the productdetail.asp vector is already covered by another...

CVE-2006-6074

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via 1 the ProductID parameter in a reviews.asp, or the 2 catid or 3 subid parameter in b subProducts.asp. NOTE: the productdetail.asp vector is already covered by another...

CVE-2006-6073

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 ProductID parameter in productdetail.asp or the 2 categoryid parameter in products.asp...

CVE-2006-6074

The CVE-2006-6074 entry concerns Enthrallweb eShopping Cart with multiple SQL injection vulnerabilities. The connected PT-2006-6719 document specifies the vulnerable vectors: user-supplied input in ProductID for reviews.asp, and in cat_id/sub_id for subProducts.asp. The root cause is unsanitized ...

CVE-2006-6073

The CVE-2006-6073 entry describes multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart. The affected components are the productdetail.asp (ProductID parameter) and products.asp (categoryid parameter). The root cause is improper handling of user-supplied input leading to arbitrary ...

CVE-2006-6093: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attackers to execute arbitrary PHP code via a URL in the 1 adminfolder and 2 path parameters...