CVE-2007-3324

Multiple cross-site scripting XSS vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web script or HTML via the redirectUrl parameter to 1 comersuscustomerAuthenticateForm.asp or 2 comersusmessage.asp, different vectors than CVE-2004-0681...

CVE-2007-3323

CVE-2007-3323 describes an SQL injection in Comersus Shop Cart 7.07, exploitable via the idProduct parameter to comersus_optReviewReadExec.asp. Remote attackers could execute arbitrary SQL commands; the description notes it may be the same issue as CVE-2005-2190. No remediation or version-specifi...

CVE-2007-3323

SQL injection vulnerability in comersusoptReviewReadExec.asp in Comersus Shop Cart 7.07 allows remote attackers to execute arbitrary SQL commands via the idProduct parameter. NOTE: this might be the same as CVE-2005-2190.2...

CVE-2007-3324

CVE-2007-3324 documents multiple XSS vulnerabilities in Comersus Cart 7.07, enabling remote attackers to inject arbitrary script or HTML via the redirectUrl parameter to comersus_customerAuthenticateForm.asp or comersus_message.asp. The description notes these are different vectors than CVE-2004-...

csc-sqlxss.txt

--- Comersus Shop Cart 7.07 SQL Injection & XSS Comersus is an active server pages asp software for running shopping stores, integrated with the rest of your web site. Comersus ASP Cart is free and IT CAN BE used for commercial purposes. An attacker may leverage this issue to have arbitrary scrip...

Comersus Cart 7.0.7 - comersus_optReviewReadExec.asp?id SQL Injection

Comersus Cart 7.0.7 - comersusoptReviewReadExec.asp?id SQL Injection source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or...

Comersus Cart 7.0.7 - comersus_message.asp redirectUrl Cross-Site Scripting

Comersus Cart 7.0.7 - comersusmessage.asp redirectUrl Cross-Site Scripting source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data...

Comersus Cart 7.0.7 - comersus_customerAuthenticateForm.asp redirectUrl Cross-Site Scripting

Comersus Cart 7.0.7 - comersuscustomerAuthenticateForm.asp redirectUrl Cross-Site Scripting source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, acce...

Comersus Cart 7.0.7 - 'comersus_customerAuthenticateForm.asp' redirectUrl Cross-Site Scripting

source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. The attacker may...

Comersus Cart 7.0.7 - 'comersus_message.asp' redirectUrl Cross-Site Scripting

source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. The attacker may...

Comersus Cart 7.0.7 - 'comersus_optReviewReadExec.asp?id' SQL Injection

source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. The attacker may...

CVE-2007-3119

SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi aka Free-PayPal-Shopping-Cart 1.0 allows remote attackers to execute arbitrary SQL commands via the newsid parameter...

CVE-2007-3119

CVE-2007-3119 describes a SQL injection vulnerability in the News feature (news.asp) of Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) version 1.0. The flaw allows an attacker to craft the news_id parameter to execute arbitrary SQL commands on the backend database. The description expli...

CVE-2007-3119

SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi aka Free-PayPal-Shopping-Cart 1.0 allows remote attackers to execute arbitrary SQL commands via the newsid parameter...

CVE-2000-1243

The CVE-2000-1243 entry concerns Dansie Shopping Cart 3.04 (likely earlier) with a privacy leak where sensitive data, including user credentials, is sent to an email address controlled by the product developers. The vulnerability is described as a data leakage issue rather than a remote code exec...

CVE-2000-1243

Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers...

Sql injection

Multiple SQL injection vulnerabilities in cgi-bin/reorder2.asp in SalesCart Shopping Cart allow remote attackers to execute arbitrary SQL commands via the password field and other unspecified vectors. NOTE: the vendor disputes this issue, stating "We were able to reproduce this sql injection on a...

Dansie Cart Script Exploit Reported

Synopsis : This program -deliberately- allows arbitrary commands to be executed on the victim server. One of our clients, while installing and configuring the Dansie Shopping Cart, ran into difficulty integrating PGP, the shopping cart program, and our secure server setup. While trying to assist...

PT-2007-4294 · Salescart · Salescart Shopping Cart

Name of the Vulnerable Software and Affected Versions: SalesCart Shopping Cart affected versions not specified Description: The issue concerns SQL injection vulnerabilities in the cgi-bin/reorder2.asp file of SalesCart Shopping Cart, allowing remote attackers to execute arbitrary SQL commands via...

CACTUSHOP 6 Default Installation Allows Remote Database Disclosure

Cactushop V6 allows remote users to download the database which contains creditcard numbers and critical information. The affected carts default installation gives away the path to database file. As a result, an attacker exploiting this vulnerability will be able to obtain detailed private custom...