Midicart sql injection

Midicart sql injection ================== product descriptionfrom site:- ================== MidiCart is a Try-Before-You-Buy Shopping Cart Software, that provides all you need to create, operate, and maintain a professional Internet shop. MidiCart ASP and PHP Shopping Cart is extremely easy to us...

CactuShop XSS and SQL injection flaws

The remote host runs CactuShop, an e-commerce web application written in ASP. The remote version of this software is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied data in the script 'popuplargeimage.asp'. Successful exploitation of this issue may allow an...

osCommerce Malformed Session ID XSS Vulnerability

osCommerce is an online shop e-commerce solution under on going development by the open source community. Its feature packed out-of-the-box installation allows store owners to setup, run, and maintain their online stores with minimum effort and with absolutely no costs or license fees involved...

osCommerce directory traversal

The remote host is running osCommerce, a widely installed open source shopping e-commerce solution. The remote version of this software is vulnerable to a directory traversal flaw which may be exploited by an attacker to read arbitrary files on the remote server with the privileges of the web...

Rich Media E-Commerce Stores Sensitive Information Insecurely

A security vulnerability in Rich Media SPDX-FileCopyrightText: 2002 SecurITeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10874";...

CactuShop XSS and SQL injection flaws

The remote host runs CactuShop, an e-commerce web application written in ASP. The remote version of this software is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied data in the script SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be...

просмотр файлов в JShop Server 1.3.0

Здравствуйте, 3APA3A. вот нашел новый баг: Software: JShop Server 1.3.0 Vendor: JShop E-Commerce http://www.jshop.co.uk/ Vulnerability: возможность чтения файлов Risk: низкий Date: 30.09.2005 discovered by durito -duritoatmaildotru- HTTP: www.lwb57.org www.carder-world.ru IRC: irc.lwb57.org:6667...

mall23.txt

ORIGINAL LINK: http://systemsecure.org/ssforum/viewtopic.php?t=277 ------------------------------------- Ref: SS21092005 SYSTEMSECURE.ORG - Advisory/Exploit PUBLIC ADVISORY ------------------------------------- » Software: Mall23 » Link: http://www.mall23.com/ » Attacks: SQL Injection » Discovere...

CVE-2004-2275

The CVE-2004-2275 entry concerns i-mall.cgi in I-Mall Commerce, where remote command execution is possible via shell metacharacters in the p parameter. The vulnerability stems from insufficient input sanitization in i-mall.cgi, enabling an attacker to pass arbitrary shell commands to the remote s...

CVE-2004-2275

i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter...

CVE-2005-2221

Dragonfly Commerce (Dragonfly) is associated with multiple SQL injection vulnerabilities in its web interface. According to the CVE records, remote attackers may modify SQL statements and possibly execute arbitrary SQL commands via user-controlled parameters: (1) key in dc_Categoriesview.asp, (2)...

CVE-2005-2221

Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the 1 key parameter to dcCategoriesview.asp, 2 dcproductslistClearance.asp, 3 PID parameter to ratings.asp, 4 dcProductsview.asp, 5 start, ...

CVE-2005-2220

Dragonfly Commerce (Dragonfly) is affected by a vulnerability where remote attackers can modify the hidden field x_DragonflyCartProductPrice to alter product prices via several endpoints (dc_Categorieslist.asp, dc_Categoriesview.asp, dc_productslist.asp, dc_productslist_Clearance.asp). The vendor...

CVE-2005-2220

Dragonfly Commerce allows remote attackers to change a product price by modifying the xDragonflyCartProductPrice hidden field to 1 dcCategorieslist.asp, 2 dcCategoriesview.asp, 3 dcproductslist.asp, and 4 dcproductslistClearance.asp. NOTE: the vendor has disputed this issue, saying that "Dragonfl...

CVE-2005-2221

Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the 1 key parameter to dcCategoriesview.asp, 2 dcproductslistClearance.asp, 3 PID parameter to ratings.asp, 4 dcProductsview.asp, 5 start, ...

CVE-2005-2220

Dragonfly Commerce allows remote attackers to change a product price by modifying the xDragonflyCartProductPrice hidden field to 1 dcCategorieslist.asp, 2 dcCategoriesview.asp, 3 dcproductslist.asp, and 4 dcproductslistClearance.asp. NOTE: the vendor has disputed this issue, saying that "Dragonfl...

PT-2005-3149 · Dragonfly · Dragonfly Commerce

Name of the Vulnerable Software and Affected Versions: Dragonfly Commerce affected versions not specified Description: The issue allows remote attackers to change a product price by modifying the x DragonflyCartProductPrice hidden field in several API endpoints, including "dc Categorieslist.asp",...

PT-2005-3150 · Dragonfly · Dragonfly Commerce

Name of the Vulnerable Software and Affected Versions: Dragonfly Commerce versions affected versions not specified Description: The issue allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via several parameters, including the key parameter to "dc...

CVE-2004-2123

The CVE-2004-2123 entry describes multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine. The issues allow remote attackers to inject arbitrary script/HTML via (1) the level parameter of productdetail.asp, (2) the searchKey parameter of searchresults.asp, and p...

CVE-2004-2123

Multiple cross-site scripting XSS vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the 1 level parameter of productdetail.asp, 2 searchKey parameter of searchresults.asp, and possibly 3 level parameter of ListCategories.asp...