CVE-2006-4218

Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter...

CVE-2006-4218

Zen Cart prior to 1.3.0.2 is affected by a directory traversal vulnerability that allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter. Impact is described as partial confidentiality, integrity, and availabilit...

CVE-2006-4214

Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via 1 GPC data to the ipngetstoredsession function in ipnmainhandler.php, which can be leveraged to modify elements of $SESSION; and allow remote authenticated users to...

CVE-2006-4215

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig9990loadFile parameter...

CVE-2006-4214

Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via 1 GPC data to the ipngetstoredsession function in ipnmainhandler.php, which can be leveraged to modify elements of $SESSION; and allow remote authenticated users to...

CVE-2006-4214

Zen Cart 1.3.0.2 and earlier contains multiple SQL injection vulnerabilities. The flaws are exploitable via: (1) GPC data to ipn_get_stored_session in ipn_main_handler.php (can modify $_SESSION), (2) session id in a cookie to whos_online_session_recreate, (3) quantity in add_cart, (4) id[] when a...

CVE-2006-4215

The CVE-2006-4215 entry concerns Zen Cart before or at version 1.3.0.2 where, when PHP register_globals is enabled, index.php's autoload mechanism is vulnerable to a remote file inclusion via autoLoadConfig[999][0][loadFile]. The NVD description states that an attacker can execute arbitrary PHP c...

CVE-2006-4215

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig9990loadFile parameter...

[SA21484] Zen Cart SQL Injection and File Inclusion Vulnerabilities

---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation...

Zen Cart autoload_func.php autoLoadConfig Array Remote File Inclusion

The version of Zen Cart installed on the remote host fails to sanitize input to the 'autoLoadConfig' array parameter before using it in 'includes/autoloadfunc.php' to include PHP code. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated attacker may be able to exploit these...

Zen Cart ipn_main_handler.php custom SQL Injection

The version of Zen Cart installed on the remote host fails to properly sanitize input to the 'custom' parameter of the 'ipnmainhandler.php' script before using it in a database query. Provided PHP's 'magicquotesgpc' setting is disabled, an unauthenticated attacker may be able to exploit this issu...

Zen Cart Web Shopping Cart 1.3.0.2 - autoload_func.php?autoLoadConfig[999][0][loadFile] Remote File Inclusion

Zen Cart Web Shopping Cart 1.3.0.2 - autoloadfunc.php?autoLoadConfig9990loadFile Remote File Inclusion source: https://www.securityfocus.com/bid/19543/info Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An...

Zen Cart Web Shopping Cart 1.3.0.2 - 'autoload_func.php?autoLoadConfig[999][0][loadFile]' Remote File Inclusion

source: https://www.securityfocus.com/bid/19543/info Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote and local files containing malicious PHP cod...

Comersus ASP shopping cart <= DataBase Downloading vuln

ComerSus ASP Shopping Cart Vendor : Www.Compersus.Com Credits : MFox HomePage : Www.HackerZ.ir Remote DataBase Getting ! Proof of Concept : Http://Target/Path/database/comersus.mdb...

CVE-2006-3800

Cross-site scripting XSS vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the "new review" text box...

CVE-2006-3794

SQL injection vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the search field. NOTE: the vendor has disputed this issue, stating "if someone were to type in any sql injection code, that code would never be queried...

AFCommerce Shopping Cart

The 'Demo Store' version of the AFCommerce Shopping Cart www.afcommerce.com is vulnerable to both SQL Injection and Cross Site Scripting XSS. SQL Injection can be tested by inserting the classic 'or 1=1-- into the search field. The result is that the first record is returned. We can also perform ...

CVE-2006-3800

Cross-site scripting XSS vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the "new review" text box...

CVE-2006-3794

CVE-2006-3794 describes a SQL injection vulnerability in the Amazing Flash AFCommerce Shopping Cart. The flaw allows remote attackers to execute arbitrary SQL commands via the search field, potentially enabling data access/manipulation. The affected component is the AFCommerce Shopping Cart searc...

CVE-2006-3800

CVE-2006-3800 describes a cross-site scripting (XSS) vulnerability in the Amazing Flash AFCommerce Shopping Cart. The issue allows remote attackers to inject arbitrary web script or HTML via the “new review” text box. Documents do not specify affected versions, root cause details beyond the input...