ECommerce Store Shop Builder

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/eShopping.txt ----------------------------------------------------------- Software: eShopping Cart Method : SQL Injection PoC:...

eshopping.txt

Aria-Security Team Advisory Original Advisory : http://aria-security.net/advisory/eShopping.txt ----------------------------------------------------------- Software: eShopping Cart Method : SQL Injection PoC: http://target/productdetail.asp?ProductID=SQL CODE...

High Performance Computers Solutions Shopping Cart - Multiple SQL Injections

High Performance Computers Solutions Shopping Cart - Multiple SQL Injections source: https://www.securityfocus.com/bid/21093/info High Performance Computers Solutions Shopping Cart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data befo...

Hpecs Shopping Cart Remote Login Bypass Vulnerability

Exploit for unknown platform in category web applications ===================================================== Hpecs Shopping Cart Remote Login Bypass Vulnerability ===================================================== vendor site:http://hpe.net/ product:hpecs shopping cart bug:injection sql...

Pilot Cart 7.2 - Pilot.asp SQL Injection

Pilot Cart 7.2 - Pilot.asp SQL Injection source: https://www.securityfocus.com/bid/21065/info Pilot Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker ...

Hpecs Shopping Cart - Remote Authentication Bypass

Hpecs Shopping Cart - Remote Authentication Bypass vendor site:http://hpe.net/ product:hpecs shopping cart bug:injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post : http://site.com/searchlist.asp variables: HpecsFind=maingroup&searchstring='sql or just post...

Hpecs Shopping Cart - Remote Authentication Bypass

vendor site:http://hpe.net/ product:hpecs shopping cart bug:injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post : http://site.com/searchlist.asp variables: HpecsFind=maingroup&searchstring='sql or just post your query in the search engine ... laurent gaffié...

Pilot Cart 7.2 - 'Pilot.asp' SQL Injection

source: https://www.securityfocus.com/bid/21065/info Pilot Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

OpenDock FullCore 4.4 - Remote File Inclusion

--------------------------------------------------------------------------------- OpenDock FullCore = v4.4 Remote File Include Vulnerabilities --------------------------------------------------------------------------------- Author : Matdhule Contact : [email protected] Application : OpenDock...

Re: Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Full Disclosure Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Status: Full Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a...

CVE-2006-5245

Eazy Cart allows remote attackers to bypass authentication and gain administrative access via a direct request for admin/home/index.php, and possibly other PHP scripts under admin/...

CVE-2006-5246

Eazy Cart allows remote attackers to change prices and other critical fields via unspecified vectors to easycart.php, probably including the price parameter. NOTE: some details are obtained from third party information...

CVE-2006-5248

Eazy Cart stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a customer database via a direct request for admin/config/customer.dat. NOTE: the provenance of this information is unknown; the details are obtained from third...

CVE-2006-5247

Multiple cross-site scripting XSS vulnerabilities in Eazy Cart allow remote attackers to inject arbitrary web script or HTML via easycart.php, possibly related to the 1 des and 2 qty parameters in an add action, and via other unspecified vectors. NOTE: some details are obtained from third party...

CVE-2006-5245

Eazy Cart allows remote attackers to bypass authentication and gain administrative access via a direct request for admin/home/index.php, and possibly other PHP scripts under admin/...

CVE-2006-5248: Undefined Security Weakness

Eazy Cart stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a customer database via a direct request for admin/config/customer.dat. NOTE: the provenance of this information is unknown; the details are obtained from third...

CVE-2006-5245

Summary (CVE-2006-5245): Eazy Cart is affected by a authentication bypass vulnerability in the admin area. A remote attacker can gain administrative access by issuing a direct request to a file such as admin/home/index.php (and potentially other PHP scripts under the admin/ directory), bypassing ...

CVE-2006-5247

CVE-2006-5247 concerns multiple cross-site scripting (XSS) vulnerabilities in Eazy Cart. The affected component is the web application’s easycart.php, with possible vectors including the (1) des and (2) qty parameters in an add action and other unspecified vectors. The description and connected s...

CVE-2006-5248

CVE-2006-5248 affects Eazy Cart: sensitive customer data stored under the web root with insufficient access control, allowing remote retrieval of admin/config/customer.dat via direct request. Multiple sources (NVD, Red Hat, CVE List, CVE Details) describe the same issue. Root cause is improper ac...

CVE-2006-5245: Undefined Security Weakness

Eazy Cart allows remote attackers to bypass authentication and gain administrative access via a direct request for admin/home/index.php, and possibly other PHP scripts under admin/...