Joomla! Component IXXO Cart! Standalone and - SQL Injection

Joomla! Component IXXO Cart! Standalone and - SQL Injection Original advisory at: http://www.davidsopas.com/2009/07/25/ixxo-cart-standalone-and-joomla-component-sql-injection/ Ref. DSF-03-2009 – IXXO Cart! Standalone and Joomla Component SQL Injection Vendor: IXXO Internet Solutions Status:...

IXXO Cart! Standalone and Joomla Component SQL Injection Vulnerability

Exploit for unknown platform in category web applications ====================================================================== IXXO Cart! Standalone and Joomla Component SQL Injection Vulnerability ====================================================================== Ref. DSF-03-2009 – IXXO...

PT-2009-2346 · Zen Cart · Zen Cart

Name of the Vulnerable Software and Affected Versions: Zen Cart versions 1.3.8 through 1.3.8a Description: A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files via a .. dot dot in the loader file parameter in admin/includes/initsystem.php when...

IXXO Cart! Standalone and Joomla Component SQL Injection

Original advisory at: http://www.davidsopas.com/2009/07/25/ixxo-cart-standalone-and-joomla-component-sql-injection/ Ref. DSF-03-2009 – IXXO Cart! Standalone and Joomla Component SQL Injection Vendor: IXXO Internet Solutions Status: Patched by vendor IXXO Cart! IXXO Cart is an extremely powerful p...

Joomla! Component IXXO Cart! Standalone and - SQL Injection

Original advisory at: http://www.davidsopas.com/2009/07/25/ixxo-cart-standalone-and-joomla-component-sql-injection/ Ref. DSF-03-2009 – IXXO Cart! Standalone and Joomla Component SQL Injection Vendor: IXXO Internet Solutions Status: Patched by vendor IXXO Cart! IXXO Cart is an extremely powerful...

Shopping Cart Selling SQL Injection / XSS

0000000000000000000000000000000000 000000000000000000000 00000000000000000000000000000000000 0000000000000000 00000000000000000000000000000000 + Shopping Cart Selling Script XSS/bSQL/SQL Multiple Vulnerabilities + Software : Shopping Cart Selling Script + Author : 599eme Man + Contact :...

Atlantic SimpleCaddy Shopping Cart Price Manipulation

SENKED-2009-0001 - Atlantic SimpleCaddy Shopping Cart Price Manipulation senked security advisory http://www.senked.com/ Date Published: 2009-07-01 Last Update: 2009-07-01 Advisory ID: SENKED-2009-0001 Bugtraq ID: none CVE Name: none Title: Atlanticintelligence SimpleCaddy Shoopuing Cart Price...

CVE-2009-2255

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/recordcompany.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the recordcompanyimage parameter in conjunction with a PATHINFO of passwordforgotten.php, then...

CVE-2009-2254

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the querystring parameter in an execute action, in conjunction with a PATHINFO of passwordforgotten.php, related to a "SQL...

Design/Logic Flaw

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/recordcompany.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the recordcompanyimage parameter in conjunction with a PATHINFO of passwordforgotten.php, then...

Sql injection

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the querystring parameter in an execute action, in conjunction with a PATHINFO of passwordforgotten.php, related to a "SQL...

CVE-2009-2254

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the querystring parameter in an execute action, in conjunction with a PATHINFO of passwordforgotten.php, related to a "SQL...

CVE-2009-2255

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/recordcompany.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the recordcompanyimage parameter in conjunction with a PATHINFO of passwordforgotten.php, then...

CVE-2009-2255

Zen Cart 1.3.8a, 1.3.8 and earlier are affected by an authentication bypass in admin/record_company.php that allows remote code execution. The vulnerability occurs because admin authentication is not enforced for that module; an attacker can upload a PHP file via the record_company_image paramete...

CVE-2009-2254

Zen Cart 1.3.8a, 1.3.8 and earlier versions are affected by an unauthenticated access flaw in admin/sqlpatch.php combined with PATH_INFO password_forgotten.php, allowing remote attackers to inject and execute arbitrary SQL via the query_string in an execute action. The issue enables potentially u...

Zen Cart 1.3.8 Remote Code Execution Exploit

No description provided by source. !/usr/bin/php ?php ------- Zen Cart 1.3.8 Remote Code Execution http://www.zen-cart.com/ Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone! A new version 1.3.8a is avaible on http://www.zen-cart.com/ BlackH : errorreportingEALL ^...

Zen Cart Detection

The remote host is running Zen Cart, an open source shopping cart application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid39500; scriptversion"1.15"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"Zen...

Zen Cart 1.3.8 Remote SQL Execution Exploit

No description provided by source. !/usr/bin/python ------- Zen Cart 1.3.8 Remote SQL Execution http://www.zen-cart.com/ Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone! A new version 1.3.8a is avaible on http://www.zen-cart.com/ BlackH : Notes: must have...

Zen Cart password_forgotten.php Admin Access Bypass

The version of Zen Cart installed on the remote host is affected by a design error that allows a remote attacker to bypass authentication and gain access to the application's admin section by appending '/passwordforgotten.php' to URLs. Successful exploitation of this vulnerability may lead to...

Zen Cart Ecommerce 1.3.8 Code Execution

!/usr/bin/php | ======================================================================== | | | $system php $argv0 | | Notes: ex: http://victim.com/site no slash | | | ======================================================================== ";exit1; $url = $argv1; $trick = "/passwordforgotten.php"...