CVE-2020-28456 Cross-site Scripting (XSS)

The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting XSS via the admin panel...

CVE-2020-28456

The CVE-2020-28456 entry affects s-cart/core before version 4.4, with a Cross-site Scripting (XSS) vulnerability exploitable via the admin panel. The root cause is improper handling of input in the admin interface, enabling injection of client-side code. Impact is client-side script execution, po...

CVE-2020-28457

The CVE-2020-28457 entry is backed by concrete data across sources: it affects the Laravel-based e-commerce package s-cart/core up to version 4.3.x and is triggered by a XSS in the admin dashboard search (AdminOrderController.phpindex) . The vulnerability allows injection of malicious scripts via...

S-cart Cross-Site Scripting Vulnerability

S-cart is a Php-based e-commerce management platform from the S-cart community. A cross-site scripting vulnerability exists in s-cart core before version 4.4, which stems from a lack of detection of client-side input in the search function of the admin dashboard in...

S-cart 跨站脚本漏洞

S-cart is a Php-based e-commerce management platform for the S-cart community. A cross-site scripting vulnerability exists in s-cart core before version 4.4, which stems from vulnerability to administration panel cross-site scripting XSS attacks. An attacker can exploit the vulnerability to execu...

CVE-2020-28838

Cross Site Request Forgery CSRF in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart...

CVE-2020-28838

Cross Site Request Forgery CSRF in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart...

Opencart Cross-Site Request Forgery Vulnerability

Opencart is an open source e-commerce system from China Opencart company . The system provides modules for product reviews, product ratings, and product additions. OpenCart Ltd. A cross-site request forgery vulnerability exists in Opencart CMS version 3.0.3.6, which can be exploited by an attacke...

OpenCart 3.0.3.6 - Cross Site Request Forgery

Exploit Title: OpenCart 3.0.3.6 - Cross Site Request Forgery Date: 12-11-2020 Exploit Author: Mahendra Purbia Mah3Sec Vendor Homepage: https://www.opencart.com Software Link: https://www.opencart.com/index.php?route=cms/download Version: OpenCart CMS - 3.0.3.6 Tested on: Kali Linux Description:...

Cross-site Scripting (XSS)

Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS. PoC:...

Logic Flaw Vulnerability in WordPress Simple PayPal Shopping Cart

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases. A logic flaw exists in WordPress Simple PayPal Shopping Cart. An attacker can exploit the vulnerability to modify the payment amount...

Cross-site Scripting (XSS) - Generic in s-cart/core

Description s-cart is a free e-commerce website project for businesses, built on the Laravel framework. this package is vulnerable to Stored Cross-Site Scripting XSS. https://github.com/s-cart/s-cart https://s-cart.org/about.html Steps To Reproduce-: 1 install https://github.com/s-cart/s-cart...

PrestaShop Access Control Error Vulnerability (CNVD-2020-64754)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop versions prior to 1.7.6.9, which can be...

CVE-2020-26224

In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9...

Abandoned Cart Lite for WooCommerce < 5.8.3 - Unauthenticated SQL Injection

The plugin is affected by an unauthenticated SQL injection via the billingfirstname parameter of the savedata AJAX call. From the original researcher: ./sqlmap.py -u https://example.com/wp-admin/admin-ajax.php --cookie='cookies content here' --method='POST'...

Abandoned Cart Lite for WooCommerce < 5.8.3 - Unauthenticated SQL Injection

The plugin is affected by an unauthenticated SQL injection via the billingfirstname parameter of the savedata AJAX call. PoC From the original researcher: ./sqlmap.py -u https://example.com/wp-admin/admin-ajax.php --cookie='cookies content here' --method='POST'...

WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.8.2 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found by Slavco Mihajloski mslavco in WordPress Abandoned Cart Lite for WooCommerce plugin versions = 5.8.2. Solution Update the WordPress Abandoned Cart Lite for WooCommerce plugin to the latest available version at least 5.8.3...

CSE Bookstore 1.0 Cross Site Scripting

Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting Date: 30/10/2020 Exploit Author: Vyshnav NK Vendor Homepage: https://projectworlds.in/ Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip Version: 1.0 Tested on: Window...

CS-Cart 1.3.3 - 'classes_dir' LFI

Exploit Title: CS-Cart unauthenticated LFI Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.4 Vulnerability Type: unauthenticated LFI...

CS-Cart 1.3.3 Remote Code Execution

Exploit Title: CS-Cart authenticated RCE Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.3 Vulnerability Type: authenticated RCE get PHP shells from http://pentestmonkey.net/tools/web-shells/php-reverse-shell edit ...