acartSQL.txt

Title: A-CART Pro & A-CART 2.0 Input Validation Holes Software: A-CART Pro & A-CART 2.0 Vendor: http://www.alanward.net Underlying OS: Windows. Description: A-CART is an ASP shopping cart application written in VBScript. The system allows a customer to browse through an inventory of products and...

CVE-2004-0350

The CVE-2004-0350 entry affects the SpiderSales shopping cart, which does not enforce a minimum length for the private key. This weakens key material quality and can let local users obtain the private key by factoring, with an in‑the‑wild risk limited by local access and a low base score (2.1). T...

CVE-2004-0240

Directory traversal vulnerability in X-Cart 3.4.3 allows remote attackers to view arbitrary files via a .. dot dot in the shopclosedfile argument to auth.php...

CVE-2004-0350

SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring...

CVE-2004-0240

CVE-2004-0240 describes a directory traversal vulnerability in X-Cart 3.4.3 where remote attackers can view arbitrary files by supplying a ".." sequence in the shop_closed_file parameter to auth.php . The root cause is insufficient input validation on the parameter leading to path traversal. The ...

CVE-2004-0241

X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perlbinary argument in 1 upgrade.php or 2 general.php...

CVE-2004-0242

X-Cart 3.4.3 allows remote attackers to gain sensitive information via a mode parameter with 1 phpinfo command or 2 perlinfo command...

CVE-2004-0348

CVE-2004-0348 pertains to SpiderSales Shopping Cart software, affecting the viewCart.asp component. The root cause is an SQL injection via the userId parameter, enabling a remote attacker to execute arbitrary SQL statements with full impact on confidentiality, integrity, and availability (CVSS v2...

CVE-2004-0242

X-Cart 3.4.3 is affected by CVE-2004-0242. An attacker can remotely read sensitive information by supplying a mode parameter that triggers phpinfo or perlinfo commands. The vulnerability enables information disclosure in the affected product via the web interface; no exploitation or mitigations a...

CVE-2004-0241

CVE-2004-0241 affects X-Cart 3.4.3 (Qualiteam X-Cart). The vulnerability allows remote attackers to execute arbitrary commands by supplying output in the perl_binary parameter in either upgrade.php or general.php. The underlying cause is improper handling of the perl_binary argument, leading to a...

CVE-2004-0351

The CVE-2004-0351 issue concerns Spider Sales shopping cart, where the private key is stored in the same database/table as the public key. This design enables local users with database access to decrypt data, affecting confidentiality (partial). The available sources describe the vulnerable behav...

Spider Sales shopping cart software multiple security vulnerabilities

S-Quadra Advisory 2004-03-03 Topic: Spider Sales shopping cart software multiple security vulnerabilities Severity: High Vendor URL: http://www.spidersales.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20040303.txt Release date: 03 Mar 2004 1. DESCRIPTION "Spider Sales is a powerful...

SpiderSales Shopping Cart SQL injection

The remote host is running the SpiderSales Shopping Cart CGI suite. There is a bug in this suite which may allow an attacker to force it to execute arbitrary SQL statements on the remote host. An attacker may use this flaw to gain the control of the remote website and possibly execute arbitrary...

IGeneric Free Shopping Cart 1.4 - Cross-Site Scripting

IGeneric Free Shopping Cart 1.4 - Cross-Site Scripting source: https://www.securityfocus.com/bid/9773/info It has been reported that iGeneric Free Shopping Cart is prone to a cross-site vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI...

IGeneric Free Shopping Cart 1.4 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/9773/info It has been reported that iGeneric Free Shopping Cart is prone to a cross-site vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI parameters Exploitation could allow for theft of cookie-based...

Qualiteam X-Cart 3.x - general.php?perl_binary Arbitrary Command Execution

Qualiteam X-Cart 3.x - general.php?perlbinary Arbitrary Command Execution source: https://www.securityfocus.com/bid/9560/info X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of...

xcart343.txt

X-Cart ttp://www.x-cart.comis a well distributed PHP e-commerce solution. We have discovered some security related bugs in X-Cart Version 3.4.3. It is possible that other versions are vulnerable too. Any visitor can view any file on the web server. This URL my be used as proof of concept:...

Qualiteam X-Cart 3.x - upgrade.php?perl_binary Arbitrary Command Execution

Qualiteam X-Cart 3.x - upgrade.php?perlbinary Arbitrary Command Execution source: https://www.securityfocus.com/bid/9560/info X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of...

X-Cart vulnerability

X-Cart ttp://www.x-cart.comis a well distributed PHP e-commerce solution. We have discovered some security related bugs in X-Cart Version 3.4.3. It is possible that other versions are vulnerable too. Any visitor can view any file on the web server. This URL my be used as proof of concept:...

Qualiteam X-Cart 3.x - Multiple Remote Information Disclosure Vulnerabilities

Qualiteam X-Cart 3.x - Multiple Remote Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/9563/info X-Cart has been reported to be prone to an issue that may allow remote attackers to view any web server readable files on the affected system. The issue is caused by a...