CS-Cart 2.0.0 Beta 3 - 'Product_ID' SQL Injection

CS-Cart 2.0.0 Beta 3 dispatch SQL Injection Vulnerability Provider: www.cs-cart.com Discovered by netsoul Greetz: m1cr0n, IvanKalet, blackfalcon, str0ke Contact: netsoul2atgmail.com ALTO PARANA - PARAGUAY Ñane mba'e teete Exploit: http://cs-cart...

Sql injection

SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter...

CVE-2009-0832

SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter...

CVE-2009-0832

SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter...

CVE-2009-0832

CVE-2009-0832 describes a SQL injection in the E-Cart module 1.3 for PHP-Fusion. The vulnerability exists in items.php and allows remote attackers to inject arbitrary SQL via the CA parameter. Impact, as stated, is remote execution of SQL commands with partial confidentiality, integrity, and avai...

CVE-2008-6394

SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cscookiescustomeruserid cookie parameter...

Sql injection

SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cscookiescustomeruserid cookie parameter...

CVE-2008-6394

SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cscookiescustomeruserid cookie parameter...

CVE-2008-6394

CS-Cart 1.3.5 and earlier is affected by a SQL injection vulnerability in core/user.php via the cs_cookies[customer_user_id] cookie parameter. Remote attackers could potentially execute arbitrary SQL commands. Affected component is the web application’s user handling logic; no patch/version detai...

Sql injection

SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script aka Shopping Cart allows remote attackers to execute arbitrary SQL commands via the subcategoryid parameter...

CVE-2008-6279

Vulnerability: RakhiSoftware Price Comparison Script (Shopping Cart) exposes installation path in error messages via an invalid PHPSESSID cookie, enabling remote disclosure of sensitive information. Affected: RakhiSoftware Price Comparison Script; root cause: PHPSESSID handling leads to error det...

CVE-2008-6278

The CVE-2008-6278 entry concerns RakhiSoftware Price Comparison Script (aka Shopping Cart). Affected component: product.php. Vulnerability: reflected cross-site scripting via two parameters, category_id and subcategory_id, allowing remote attackers to inject arbitrary web script or HTML. The root...

CVE-2008-6277

CVE-2008-6277 describes an SQL injection vulnerability in the RakhiSoftware Price Comparison Script (aka Shopping Cart). The flaw is in the file product.php and is exploitable via the subcategory_id parameter, enabling a remote attacker to execute arbitrary SQL commands. This AV:N/AC:L/ Au:N/C:P/...

CVE-2008-6279

RakhiSoftware Price Comparison Script aka Shopping Cart allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message...

CVE-2008-6278

Multiple cross-site scripting XSS vulnerabilities in product.php in RakhiSoftware Price Comparison Script aka Shopping Cart allow remote attackers to inject arbitrary web script or HTML via the 1 categoryid and 2 subcategoryid parameters...

Authentication flaw

The ProcessLogin function in class.auth.php in Interspire Shopping Cart ISC 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt...

CVE-2009-0412

The ProcessLogin function in class.auth.php in Interspire Shopping Cart ISC 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt...

CVE-2009-0412

The CVE-2009-0412 entry concerns Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition. The vulnerability exists in the ProcessLogin function of class.auth.php and allows remote attackers to bypass authentication and gain administrative access by reusing the RememberToken cookie after a failed ad...

CVE-2008-6045

Session fixation vulnerability in shoppingcart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setting the XTCsid parameter...

PT-2009-1520 · Xt:Commerce · Xt:Commerce

Name of the Vulnerable Software and Affected Versions: xt:Commerce versions 3.0.4 and earlier Description: The issue allows remote attackers to hijack web sessions by setting the XTCsid parameter in the shopping cart.php file. This enables attackers to take control of user sessions, potentially...