Zen Cart admin/sqlpatch.php模块SQL注入漏洞

BugCVE: CVE-2009-2254 BUGTRAQ: 35468 Zen Cart没有对admin/sqlpatch.php模块强制管理认证，这允许远程攻击者在请求中通过querystring和PATHINFO参数执行SQL注入攻击。 Zen Cart 1.3.8 厂商补丁： Zen Ventures ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.zen-cart.com/forum/showthread.php?t=130161 !/usr/bin/python ------- Zen Cart 1.3.8...

Zen Cart record_company.php模块远程代码执行漏洞

BugCVE: CVE-2009-2255 BUGTRAQ: 35467 Zen Cart没有对admin/recordcompany.php模块强制管理认证，远程攻击者可以通过recordcompanyimage和 PATHINFO参数上传.php文件，并通过直接请求images/中的文件来访问上传的文件，导致执行任意指令。 Zen Cart 1.3.8 厂商补丁： Zen Ventures ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.zen-cart.com/forum/showthread.php?t=1301...

Paypal Shopping Cart Script - index.php?cid SQL Injection

Paypal Shopping Cart Script - index.php?cid SQL Injection source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data...

Paypal Shopping Cart Script - index.php Multiple Cross-Site Scripting Vulnerabilities

Paypal Shopping Cart Script - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently...

Paypal Shopping Cart Script - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal...

Paypal Shopping Cart Script - 'index.php?cid' SQL Injection

source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal...

CVE-2008-6986

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...

CVE-2008-6985

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

Sql injection

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

Sql injection

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...

CVE-2008-6985

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

CVE-2008-6986

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct...

CVE-2008-6986

Zen Cart 1.3.0–1.3.8a is affected by CVE-2008-6986 due to an SQL injection in actionMultipleAddProduct in includes/classes/shopping_cart.php. When magic_quotes_gpc is disabled, the products_id[] array used by multiple_products_add_product can lead remote attackers to execute arbitrary SQL command...

CVE-2008-6985

Zen Cart vulnerability CVE-2008-6985 affects the shopping_cart.php component (includes/classes/shopping_cart.php) in versions 1.2.0 through 1.3.8a, where SQL injection is possible via the id parameter during add or update cart operations when magic_quotes_gpc is disabled. The connected NVD entry ...

CVE-2008-6969

Multiple cross-site scripting XSS vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to inject arbitrary web script or HTML via the 1 stepid and 2 CHECKOUTCZBLOWFISHKEY parameters...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to inject arbitrary web script or HTML via the 1 stepid and 2 CHECKOUTCZBLOWFISHKEY parameters...

CVE-2008-6969

CVE-2008-6969 concerns multiple cross-site scripting (XSS) vulnerabilities in Avactis Shopping Cart, specifically in checkout.php for versions 1.8.0 and 1.8.1. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) step_id and (2) CHECKOUT_CZ_BLOWFISH_KEY parameters....

CVE-2008-6969

Multiple cross-site scripting XSS vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to inject arbitrary web script or HTML via the 1 stepid and 2 CHECKOUTCZBLOWFISHKEY parameters...

[BONSAI] SQL Injection in CS-Cart

Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in CS-Cart 1. Advisory Information Title: SQL Injection in CS-Cart Advisory ID: BONSAI-2009-0100 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/cs-cartSQL-injection-0100.txt Date published:...

PHP Easy Shopping Cart 3.1R - subitems.php Cross-Site Scripting

PHP Easy Shopping Cart 3.1R - subitems.php Cross-Site Scripting source: https://www.securityfocus.com/bid/44142/info PHP Easy Shopping Cart is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...