CVE-2006-6868

Multiple cross-site scripting XSS vulnerabilities in Zen Cart Web Shopping Cart before 1.3.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

fishyshoop-vuln.txt

Synopsis ======== The Fishyshoop shopping cart software contains a vulnerability which allows arbitrary users to create accounts with administrator privileges Background ========== Fishyshoop is a suite of PHP scripts allowing anybody to create an attractive online store. Affected Versions...

Fishyshoop Security Vulnerability

Synopsis ======== The Fishyshoop shopping cart software contains a vulnerability which allows arbitrary users to create accounts with administrator privileges Background ========== Fishyshoop is a suite of PHP scripts allowing anybody to create an attractive online store. Affected Versions...

Valdersoft Shopping Cart Common.PHP远程文件包含漏洞

Valdersoft Shopping Cart是一款基于PHP的WEB应用程序。 Valdersoft Shopping Cart不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Common.PHP'脚本对用户提交的'commonIncludePath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Valdersoft Shopping Cart 3.0 目前没有解决方案提供： http://www.valdersoft.com/valdersoftshoppingcart.php...

CVE-2006-6691

Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to 1 admin/include/common.php, 2 include/common.php, or 3 commoninclude/common.php...

CVE-2006-6691

Valdersoft Shopping Cart 3.0 and earlier are affected by multiple PHP remote file inclusion vulnerabilities. The issue arises from remote attackers being able to include files via a URL supplied in the commonIncludePath parameter to admin/include/common.php, include/common.php, or common_include/...

CVE-2006-6691

Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to 1 admin/include/common.php, 2 include/common.php, or 3 commoninclude/common.php...

Valdersoft Shopping Cart v3.0 (E-Commerce Software)*****[ commonIncludePath ] Remote File Include

Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include $commonIncludePath."common.php" ; + + Exploit :...

Valdersoft Shopping Cart v3.0 (E-Commerce Software)*****[ commonIncludePath ] Remote File Include

Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include $commonIncludePath."common.php" ; + + Exploit :...

Valdersoft Shopping Cart 3.0 Multiple Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ========================================================================= Valdersoft Shopping Cart 3.0 Multiple Remote File Include Vulnerabilities ========================================================================= Valdersoft Shoppi...

Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions

Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +cod...

Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions

Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include $commonIncludePath."common.php" ; + + Exploit :...

shopsite-xss.txt

Hackers Center Security Group http://www.hackerscenter.com/ Doz's Security Advisory Desc: ShopSite Shopping Cart Multiple XSS Risk: Medium ShopSite™ is the easiest-to-use shopping cart software for small to medium-sized businesses. ShopSite ecommerce shopping cart is one of the most user-friendly...

CVE-2006-6464

Summary: CVE-2006-6464 relates to Midicart’s viewcart where the Qty field accepts negative numbers, allowing manipulation of the cart total to be smaller. The PT-2006-7073 entry confirms the vulnerability in Midicart (no affected versions specified) and states there is no information about a fix ...

CVE-2006-6464

viewcart in Midicart accepts negative numbers in the Qty quantity field, which allows remote attackers to obtain a smaller total price for a shopping cart...

PT-2006-7073 · Midicart · Midicart

Name of the Vulnerable Software and Affected Versions: Midicart affected versions not specified Description: The issue allows remote attackers to manipulate the total price of a shopping cart by entering negative numbers in the Qty field of the viewcart function in Midicart. Recommendations: At t...

Zen Cart多个SQL注入漏洞

Zen Cart是一款基于PHP的新闻管理程序。 Zen Cart不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Zen Cart Web Shopping Cart 1.3 Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.1.2 d...

QualiteamXCart远程命令执行漏洞

X-Cart是一款基于PHP的电子商务程序。X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart3.4.3 厂商补丁：Qualiteam --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.x-cart.com/...

ECWShopindex.php远程SQL注入漏洞 Exploit

No description provided by source. 跨站脚本： http://www.victim.com/index.php?c=srch&ctg=Cat1&id=754ce025144839c2abe369c36d90d8e9&key=1&comp=1&min=1&max=scriptvar%20xss=31337;alertxss;/script 信息泄漏和可能的SQL注入:...

CVE-2006-6207

SQL injection vulnerability in products.asp in Evolve shopping cart aka Evolve Merchant allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error...