CVE-2017-2143

CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php...

CVE-2017-2143

CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php...

CVE-2017-2117

Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors...

Design/Logic Flaw

CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows remote attackers to bypass access restriction to obtain customer information via orders.pre.php...

CVE-2017-2090

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-2098

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

Authentication flaw

CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php...

CVE-2017-2139

CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows remote attackers to bypass access restriction to obtain customer information via orders.pre.php...

CVE-2017-2143

CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php...

CVE-2017-2139

CS-Cart Japanese Edition (and CS-Cart Multivendor Japanese Edition) versions up to 4.3.10 are affected. The issue allows remote attackers to bypass access restrictions (CWE-425) and obtain customer information via orders.pre.php. Impact is unauthenticated access to consumer data (e.g., name and s...

CVE-2017-2143

CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, and CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier, are affected by an unauthenticated access-permission bypass (CWE-425) that allows a remote attacker to bypass restrictions and create a request to return a customer-purchased item...

1gifts.biz XSS vulnerability

Vulnerable URL: http://1gifts.biz/cart.php?cartid=0...

cartrover.com XSS vulnerability

Vulnerable URL: https://www.cartrover.com/integrations/cs-cart.php?id=CS-Cart"alert/OPENBUGBOUNTY/...

Code injection

Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers...

CVE-2016-4862

Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers...

CVE-2016-4862

The CVE-2016-4862 issue affects the Twigmo add-on shipped with CS-Cart v4.3.9 and earlier (and CS-Cart Multi-Vendor v4.3.9 and earlier). The vulnerability is a PHP object injection flaw caused by unserializing untrusted input in Twigmo, enabling a remote authenticated user to execute arbitrary PH...

CVE-2016-4862

Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers...

CS-Cart Japanese Edition vulnerable to cross-site request forgery

Overview CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition contains a cross-site request forgery CWE-352 vulnerability. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

CS-Cart Japanese Edition fails to restrict access permissions

Overview CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition fails to restrict access permissions CWE-425. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

CS-Cart Japanese Edition fails to restrict access permissions

Overview CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition fails to restrict access permissions CWE-425. Note that this vulnerability is different from JVN14396697. Hirota Kazuki of Mitsui Bussan Secure Directions,Inc. reported this vulnerability to IPA. JPCERT/C...