Zen Cart Multiple Vulnerabilities (Feb 2014)

Zen Cart is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

phpmywind sql注入二

简要描述： 这套程序一个月前读过，发现了一些问题，厂商来注册了，就一并提交给厂商修复吧！希望厂商不要回复我说某创某宇已经联系过你们报告过该漏洞，我想说的是请尊重作者！ 详细说明： 这个漏洞我之前在t00ls发过（请不要怀疑我抄袭），因为当时厂商没来乌云，现在厂商终于来了，就提交一下，希望尽快修补。 之前提交的注射一需要登录，这个地方不需要登录 shoppingcart.php //初始化参数 $a = isset$a ? $a : ''; //添加购物车 if$a == 'addshopingcart' //构成选中属性 ifisset$typeid//同样未做过滤 //获取商品属性...

CVE-2013-7317

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CVE-2013-7317

Multiple cross-site scripting XSS vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 settingsfile or 2 datafile parameter to a ampie.swf, b amline.swf, or c amcolumn.swf...

CVE-2013-7317

CVE-2013-7317 affects CS-Cart prior to 4.1.1 and involves cross-site scripting (XSS) via the vulnerable parameters settings_file and data_file to the SWF files ampie.swf, amline.swf, or amcolumn.swf. The issue allows remote attackers to inject arbitrary script/HTML in the context of the user’s br...

UAEPD Shopping Script SQL Injection Vulnerabilty

Exploit for php platform in category web applications .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.uaepd.net/ .:. Dork : 1inurl:”products.php?catid=” “Powered by: PD ” 2inurl:”products.php?pid” “Power...

CS-Cart version 4.0.2 contains cross-site scripting vulnerabilities

Overview CS-Cart version 4.0.2 and possibly earlier versions contain cross-site scripting XSS vulnerabilities CWE-79. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CS-Cart version 4.0.2 and possibly earlier versions contain cross-site...

CVE-2014-1618

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

Sql injection

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

CVE-2014-1618

CVE-2014-1618 affects the UAEPD Shopping Cart Script with multiple SQL injection vulnerabilities. The vulnerability allows remote attackers to execute arbitrary SQL commands through the following parameters: cat_id or p_id in products.php, and id in page.php or news.php. The cvss base score is 7....

CVE-2014-1618

Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the 1 catid or 2 pid parameter to products.php or id parameter to 3 page.php or 4 news.php...

Joomla QuickSell File Seller Plugin - Multiple XSS

Latest QuickSell Joomla Plugin suffers on multiple Cross Site Scripting vulnerabilities because of poor variables filtering. Title: Joomla - QuickSell File Seller Plugin - Multiple XSS Date: 01.19.14 Version: 3.3.2 Latest ATM Demo: demo.shopfiles.com...

UAEPD Shopping Script SQL Injection

uaepd script – Multiple Sql Injection Vulnerabilty ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.uaepd.net/ .:. Dork :...

UAEPD Shopping Script - news.php?id SQL Injection

UAEPD Shopping Script - news.php?id SQL Injection source: https://www.securityfocus.com/bid/64734/info UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can explo...

UAEPD Shopping Script - 'products.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/64734/info UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating the SQL query logi...

Zen Cart <= 1.5.1 Information Disclosure Vulnerability

Zen Cart is prone to an information disclosure vulnerability. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Zen-Cart Database Backup Disclosure

Zen-cart Database Backup Disclosure Vulnerability /+/ Exploit title : Zen-cart Database Backup Disclosure Vulnerability /+/ Script : Zen-cart /+/ Version : 1.5.1 /+/ Author : JoKeRStEx /+/ Date : 22/07/2013 /+/ Category : Webapps /+/ Google Dork : inurl:"/zcinstall/sql/" First You can Donwload...

PHPSHE电商程序SQL注入漏洞

简要描述： PHPSHE SQL注入3 详细说明： 在添加购物车时，存在过滤。 但是在更新购物车商品数量时，没有过滤，导致SQL注入。 在/module/index/order.php文件： //@ 购物车商品更改数量 @// case 'cartnum': $money'orderproductmoney' = $money'orderwlmoney' = $money'ordermoney' = 0; if pelogin'user' $result = $db-peupdate'cart', array'userid'=$suserid,...

Tiendas Online SQL Injection

Tiendas Online SQL Injection Vulnerability ============================================================================= Last login: Sat Sep 14 01:59:02 on console / / / / / / / / / / / / / : / / / / / / / / / / / / / / / | / / / / / / / / / / / / / // / // / / / / --X-- / / / / / / / / / /...