CVE-2002-2302

3D3.Com ShopFactory 5.5 through 5.8 allows remote attackers to modify the prices in their shopping carts by modifying the price in a hidden form field...

ShopFactory shopping cart price manipulation

Trust Factory Security Advisory TF20021004 Discovery Date: October 4, 2002 Release Date: December 2, 2002 ID: TF20021004 Title: ShopFactory shopping cart price manipulation Impact: Customers can modify the price of items at will Affected Technology: Online shopping carts created with ShopFactory...

wp-02-0012: Carello 1.3 Remote File Execution

Westpoint Security Advisory Title: Carello 1.3 Remote File Execution Risk Rating: Medium Software: Carello Shopping Cart Platforms: Win2k, WinNT Vendor URL: www.carelloweb.com Author: Matt Moore [email protected] Date: 10th July 2002 Advisory ID: wp-02-0012 Overview: ========= Carello 1.3 is ...

[UNIX] SunShop Shopping Cart Security Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...

SunSop: cross-site-scripting bug

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ppp-design found the following cross-site-scripting bug in SunShop Shopping Cart: Details - ------- Product: SunShop Shopping Cart Version: 2.5 and maybe all versions before OS affected: all OS with php and mysql Vendor-URL:...

CVE-2001-0985

Affected product: Hassan Consulting Shopping Cart 1.23. Vulnerability: arbitrary command execution via shell metacharacters in the URL parameter “page” leading to remote code execution. Root cause is unsafely handling the page parameter in shop.pl, allowing user-supplied input to be interpreted b...

CVE-2001-0992

ShopPlus CGI (shopplus.cgi) in the ShopPlus shopping cart is vulnerable to remote arbitrary command execution via shell metacharacters in the file parameter. The issue allows execution with the web server’s privileges, with CVSS base score 7.5 (HIGH) and network attack vector with no authenticati...

CVE-2001-0985

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter...

CVE-2001-0992

shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter...

CVE-2001-0985: Undefined Security Weakness

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter...

VERISIGN "PAYFLOW LINK" PAYMENT SERVICE SECURITY FAILURE

VERISIGN PAYFLOW PAYMENT SERVICE SECURITY FAILURE PAYFLOW LINK SERVICE DESCRIPTION: The final checkout page of various online shopping cart applications presents the shopper with a form asking for credit card acct, exp date, etc. When the shopper submits the form, the data is sent directly to the...

Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting

Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting source: https://www.securityfocus.com/bid/3714/info Aktivate is a shopping cart system which is geared towards Unix and Linux users, uses MySQL as a backend, and is written in Perl. Aktivate is prone to cross-site scripting attacks. It is possib...

PT-2001-2334 · Agora · Agora

Name of the Vulnerable Software and Affected Versions: Agora versions 3.0a through 4.0g Description: The issue allows remote attackers to execute Javascript on other clients via the cart id parameter in agora.cgi when debug mode is enabled. This occurs because of a cross-site scripting issue...

CVE-2001-0985

shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter...

Hassan Consulting Shopping Cart 1.23 - Arbitrary Command Execution

Hassan Consulting Shopping Cart 1.23 - Arbitrary Command Execution source: https://www.securityfocus.com/bid/3308/info Hassan Consulting's Shopping Cart is commercial web store software. Shopping Cart does not filter certain types of user-supplied input from web requests. This makes it possible f...

Hassan Consulting Shopping Cart 1.23 - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/3308/info Hassan Consulting's Shopping Cart is commercial web store software. Shopping Cart does not filter certain types of user-supplied input from web requests. This makes it possible for a malicious user to submit a request which causes arbitrary...

ShopPlus Cart

------------ advisory ------------ name: ShopPlus Cart Bug Information: The ShopPlus shopping cart system allows you to build a store or a mall on the Internet. Because of its flexibility, it allows you to sell virtually any product or services and fully customize the shopping experience of your...

CVE-2001-0992

shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter...

cgisecurity.com Advisory #5

Well I had about 3 advisories I was working on but my HD died and this was the only thing I could salvage. The vendor's patch is also contained below in a url. - zenomorph Cgi Security Advisory 5 [email protected] VirtualCart Shopping Cart Found April 2001 Public release June 2001 Vendor...

Pacific Software Carello 1.2.1 Shopping Cart - Command Execution

Pacific Software Carello 1.2.1 Shopping Cart - Command Execution source: https://www.securityfocus.com/bid/2729/info It is possible for a remote user to execute arbitrary commands on a host using Carello Shopping Cart software. A specially crafted HTTP request could cause inetinfo.exe to consume...