PreProjects E-Smart Cart SQL Injection Vulnerability

PreProjects E-Smart Cart is an integrated shopping portal, search engine and email-based forum solution from PreProjects Australia. An SQL injection vulnerability exists in the embadmin/login.asp script in PreProjects E-Smart Cart, which arises from the program failing to adequately filter...

CVE-2015-2701

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

CVE-2015-2701

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

CVE-2015-2701

CVE-2015-2701 describes a CSRF vulnerability in CS-Cart 4.2.4 where an attacker can hijack a user’s authenticated session by crafting a request to profiles-update/ that changes a password. The affected product is CS-Cart 4.2.4; the underlying issue is cross-site request forgery. No explicit fixes...

YXcms1.2.7 刷账户预存款余额

简要描述： YXcms1.2.7 刷账户预存款余额 详细说明： 问题存在于protested/apps/member/controller/shopcarController.php 只判断了数目不能为负，但没有判断价格不能为负。 访问链接http://127.0.0.1/YXcmsApp1.2.7/index.php?r=member/shopcar/caradd post: 'code' = int 1 'name' = int 1 'price' = float -100 'num' = int 1 就向购物车里塞了一个负数价格的商品。 生成订单然后支付，就可以刷余额了。...

CS-Cart 4.2.4 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: CS-Cart 4.2.4 CSRF Google Dork: intext:"© 2004-2015 Simtech" Date: March 11, 2015 Exploit Author: Luis Santana Vendor Homepage: http://cs-cart.com Software Link:...

3d Cart Cross Site Scripting

Affected software: 3d cart Type of vulnerability: xss URL: http://3dcart.com/ Discovered by: Provensec Website: http://www.provensec.com Description: Hosted Shopping Cart Software to Build an Online Store Proof of concept /admin/usersview.asp?error=%3Cimg/src=%22x%3E%22onerror=...

CS-Cart 4.2.4 - Cross-Site Request Forgery

CS-Cart 4.2.4 - Cross-Site Request Forgery Exploit Title: CS-Cart 4.2.4 CSRF Google Dork: intext:"© 2004-2015 Simtech" Date: March 11, 2015 Exploit Author: Luis Santana Vendor Homepage: http://cs-cart.com Software Link:...

CS-Cart 4.2.4 - Cross-Site Request Forgery

Exploit Title: CS-Cart 4.2.4 CSRF Google Dork: intext:"© 2004-2015 Simtech" Date: March 11, 2015 Exploit Author: Luis Santana Vendor Homepage: http://cs-cart.com Software Link: https://www.cs-cart.com/index.php?dispatch=pages.gettrial&pageid=297&edition=ultimate Version: 4.2.4 Tested on: Linux +...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in zencart-ja aka Zen Cart Japanese edition 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/initincludes/initsanitize.php and...

CVE-2015-0882

CVE-2015-0882 affects Zen Cart Japanese edition (zencart-ja) in versions 1.3 jp up to 1.3.0.2 jp8 and 1.5 ja up to 1.5.1 ja. The flaw is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script or HTML via a crafted parameter related to admin/includes/ini...

Zen Cart Cross-Site Scripting Vulnerability

Zen Cart is a PHP-based WEB application. Zen Cart suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform malicious...

Zen Cart Japanese version vulnerable to cross-site scripting

Overview Zen Cart is an open source system for creating shopping websites. Zen Cart Japanese version contains a cross-site scripting vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact ...

JVN#44544694: Zen Cart Japanese version vulnerable to cross-site scripting

Zen Cart is an open source system for creating shopping websites. Zen Cart Japanese version contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the web browser of a user who is logged on as an administrator. Solution For Zen Cart v1.5 ja variants: Update t...

Zeuscart v.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assign...

Zeuscart 4.0 - Multiple Vulnerabilities

Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Advisory ID: SROEADV-2015-12 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assigned after release on...

Wordpress Shopping Cart Plugin Unrestricted File Upload (CVE-2014-9308)

An unauthorized file upload vulnerability has been reported in Wordpress Shopping Cart Plugin. A remote attacker could exploit this vulnerability by uploading a file to a server running the vulnerable application. Successful exploitation of this vulnerability could allow a remote attacker to...

CVE-2015-1178

Multiple cross-site scripting XSS vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 productid or 2 categoryid parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 productid or 2 categoryid parameter...