Qualiteam X-Cart Multiple Script perl_binary Parameter Arbitrary Command Execution

The remote host is running Qualiteam X-Cart - a shopping cart software written in PHP. There is a bug in this software that could allow an attacker to execute arbitrary commands on the remote web server with the privileges of the web user. In addition to this, there are some flaws that could allo...

Qualiteam X-Cart 3.x - Multiple Remote Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/9563/info X-Cart has been reported to be prone to an issue that may allow remote attackers to view any web server readable files on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the...

Qualiteam X-Cart 3.x - 'upgrade.php?perl_binary' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/9560/info X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI...

Qualiteam X-Cart 3.x - 'general.php?perl_binary' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/9560/info X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI...

phpShop Web Shopping Cart 0.6.1 -b - Multiple Function Cross-Site Scripting Vulnerabilities

phpShop Web Shopping Cart 0.6.1 -b - Multiple Function Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/9437/info Multiple vulnerabilities have been reported to exist in the software that may allow an attacker to carry out attacks against the database, disclose...

QuikStore Shopping Cart quikstore.cgi template Parameter Traversal Arbitrary File Access

The CGI 'quickstore.cgi' is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the HTTP daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date: Tue, 23 Dec 2003 20:27:51 +0800 From: DrPonidi Haryanto Subject:...

CVE-2003-1517

cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message...

quikstore.txt

Indonesia Security Development Team Advisory QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users ===================================================================== Advisory Name: QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users Release Date:...

QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users

Indonesia Security Development Team Advisory QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users ===================================================================== Advisory Name: QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users Release Date:...

iSoft-Solutions QuikStore Shopping Cart 2.12 - template Directory Traversal

iSoft-Solutions QuikStore Shopping Cart 2.12 - template Directory Traversal source: https://www.securityfocus.com/bid/9283/info It has been reported that QuikStore Shopping Cart may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root...

iSoft-Solutions QuikStore Shopping Cart 2.12 - store Full Path Disclosure

iSoft-Solutions QuikStore Shopping Cart 2.12 - store Full Path Disclosure source: https://www.securityfocus.com/bid/9282/info It has been reported that QuikStore Shopping Cart may be prone to an information disclosure vulnerability due to insufficient sanitization of user-supplied data through th...

iSoft-Solutions QuikStore Shopping Cart 2.12 - 'template' Directory Traversal

source: https://www.securityfocus.com/bid/9283/info It has been reported that QuikStore Shopping Cart may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '../' character sequences. The issue exists due to insufficie...

LaGarde StoreFront 5.0 Shopping Cart - login.asp SQL Injection

LaGarde StoreFront 5.0 Shopping Cart - login.asp SQL Injection source: https://www.securityfocus.com/bid/13998/info StoreFront Shopping Cart is affected by an SQL injection vulnerability. The vulnerability affects the 'login.asp' script. Successful exploitation could result in a compromise of the...

LaGarde StoreFront 5.0 Shopping Cart - 'login.asp' SQL Injection

source: https://www.securityfocus.com/bid/13998/info StoreFront Shopping Cart is affected by an SQL injection vulnerability. The vulnerability affects the 'login.asp' script. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit...

commerceSQL.txt

CommerceSQL shopping cart http://commercesql.com allows remote file reading. It only needs to specially prepared page variable in index.cgi to allow reading remote files like /etc/passwd By using prepared GET page variable it allows user to read remote files Example: With...

Dansie Shopping Cart Discloses Installation Path to Remote Users

Indonesia Security Development Team Advisory Dansie Shopping Cart Discloses Installation Path to Remote Users ================================================================ Advisory Name: Dansie Shopping Cart Discloses Installation Path to Remote Users Release Date: 5:21 AM 10/20/03 Application...

Dansie Shopping Cart Discloses Installation Path to Remote Users

Indonesia Security Development Team Advisory Dansie Shopping Cart Discloses Installation Path to Remote Users ================================================================ Advisory Name: Dansie Shopping Cart Discloses Installation Path to Remote Users Release Date: 5:21 AM 10/20/03 Application...

Dansie Shopping Cart - Server Error Message Installation Full Path Disclosure

source: https://www.securityfocus.com/bid/8860/info Dansie Shopping Cart is reported to be prone to path disclosre issue in the 'db' parameter of 'cart.pl' that may lead to an attacker gaining sensitive information about the installation path of the system. Information gained by exploiting this...

[UNIX] A-CART and A-CART Pro XSS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Alan Ward A-Cart 2.0 - MSG Cross-Site Scripting

Alan Ward A-Cart 2.0 - MSG Cross-Site Scripting source: https://www.securityfocus.com/bid/8722/info A-Cart has been reported prone to a cross-site scripting vulnerability. The issue presents itself likely due to a lack of sufficient sanitization performed on data contained in the 'msg' URI...