SourceCodester Basic Shopping Cart SQL注入漏洞

SourceCodester Basic Shopping Cart is a Web application from SourceCodester USA. The program allows visitors to your online shopping site to collect items in a virtual shopping cart through multiple product pages without losing ordered items. A SQL injection vulnerability exists in SourceCodester...

CVE-2021-34165

CVE-2021-34165 details a SQL Injection vulnerability affecting the Sourcecodester Basic Shopping Cart 1.0. The vulnerability allows a remote attacker to bypass authentication and become an administrator. According to NVD metrics, the issue has high/critical impact (CVSS v3.1: 9.8) with network ac...

CVE-2021-34165

A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin...

Cross-Site Request Forgery (CSRF) in microweber/microweber

✍️ Description microweber is vulnerable to Cross-site request forgery. The app is not checking the CSRF token when adding new products to the cart. 🕵️‍♂️ Proof of Concept HTML content: HTML setTimeout = form.submit; , 2000; 1. Save the above content into an HTML file. 2. Open the file on the...

Business Logic Errors in microweber/microweber

✍️ Description microweber is vulnerable to Business Logic error through negative product price. 🕵️‍♂️ Proof of Concept HTML content: HTML 1. Save the above content into an HTML file. 2. Access the app localhost and add a product to the cart. 3. Open the HTML file and click on submit button to take...

X-Cart Concierge Module Information Disclosure

X-Cart Concierge module has been detected on the target X-Cart installation. This may present an attacker with sensitive information to mount further attacks & may leak the admin account email used to log into the store, official company name, license type of the store and other sensitive data No...

X-Cart 5.0.10 < 5.3.6.5 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.5. It is, therefore, affected by various security issues in the Core, GoSocial, ThemeTweaker & RESTAPI modules. Note that the scanner has not tested for these issue...

X-Cart 5.4.0.x < 5.4.0.13 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

X-Cart 5.0.10 < 5.3.6.8 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

X-Cart 4.4.0 < 4.7.11 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 4.4.0 4.7.10. It is, therefore, affected by multiples vulnerabilities : - A SQL injection vulnerability. - A Cross-Site Scripting XSS against embedded jQuery component. Note tha...

X-Cart 5.4.1.x < 5.4.1.8 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

X-Cart 5.0.10 < 5.3.6.1 Cross-Site Scripting

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.1. It is, therefore, affected by a XSS via the CategoryFilter2 parameter. Note that the scanner has not tested for these issues but has instead relied only on the...

X-Cart 5.0.10 < 5.3.3.0 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.3.0. It is, therefore, affected by multiples vulnerabilities : - A Remote Code execution vulnerability due to insufficient checking of uploaded content. This...

X-Cart 5.0.10 < 5.2.18 Open Redirect

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.2.18. It is, therefore, affected by a vulnerability in the redirect functionality. Note that the scanner has not tested for these issues but has instead relied only on...

WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.0.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Abandoned Cart Recovery for WooCommerce plugin versions = 1.0.4. Solution Update the WordPress Abandoned Cart Recovery for WooCommerce plugin to the latest available version at least 1.0.4.1...

X-Cart Files Information Disclosure

X-Cart sensitive files have been detected on the target X-Cart installation. This may present an attacker with sensitive information to mount further attacks. No source data...

New Admin Portal for Akamai Enterprise Application Access

The definition of a user has evolved to comprise much more than an employee, making secure access to the right application, for the right user, at the right time difficult and complex. Akamai Enterprise Application Access EAA is a unique cloud architecture that closes all inbound firewall ports,...

WordPress Sunshine Photo Cart plugin <= 2.8.28 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Sunshine Photo Cart plugin versions = 2.8.28. Solution Update the WordPress Sunshine Photo Cart plugin to the latest available version at least 2.8.29...

SQL Injection in s-cart/core

✍️ Description Searching keyword in/scadmin/currency is vulnerable to SQL injection. This will allow a user to run arbitrary SQL queries and completely delete, edit, export or change all information in the database - potentially rendering the entire platform unusable. 🕵️‍♂️ Proof of Concept Login...

CVE-2021-33394

Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker...