622 matches found
CubeCart Cross-Site Request Forgery Vulnerability (CNVD-2016-01940)
CubeCart is an open source PHP e-commerce software system. A cross-site request forgery vulnerability exists in CubeCart. When a local file is deleted, the source of the request fails to authenticate due to HTTP. A remote authentication attacker can create a specially crafted malicious web page...
CubeCart 6.0.10 CSRF / XSS / SQL Injection
Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16, 2016 Public Disclosure: March 30, 2016...
CubeCart 6.0.10 - Multiple Vulnerabilities
Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16, 2016 Public Disclosure: March 30, 2016...
Multiple Vulnerabilities in CubeCart
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in popular open source shopping software CubeCart. The discovered vulnerabilities allow a remote attacker to compromise vulnerable website and its databases, and conduct sophisticated attacks against its users. 1 SQL...
CubeCart 6.0.7 Cross Site Scripting
Security Advisory - Curesec Research Team 1. Introduction Affected Product: CubeCart 6.0.7 Fixed in: 6.0.8 Fixed Version Link: https://www.cubecart.com/thank-you/CubeCart-6.0.8.zip Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/07/2015...
CubeCart 6.0.7 Code Execution
Security Advisory - Curesec Research Team 1. Introduction Affected Product: CubeCart 6.0.7 Fixed in: 6.0.8 Fixed Version Link: https://www.cubecart.com/thank-you/CubeCart-6.0.8.zip Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor:...
Devellion CubeCart Password Reset Vulnerability
Devellion CubeCart is a free and open source e-commerce shopping cart software. The classes/admin.class.php script in Devellion CubeCart fails to properly validate that a password reset request is occurring, allowing a remote attacker to change the administrator password by sending a specially...
CVE-2015-6928
classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...
Cross site request forgery (csrf)
classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...
CVE-2015-6928
CubeCart is affected by a password-reset validation flaw in admin.class.php affecting 5.2.12–5.2.16 and 6.x (before 6.0.7). The issue allows a remote attacker to change the administrator password by sending a recovery request with a space character in the validate parameter and the administrator ...
CVE-2015-6928
classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...
CubeCart 6.0.6 Administrative Bypass
Application: CubeCart 6.0.6 5.2.12 Fixed: 07/09/2015 6.0.7 Credits: Fernando Câmara @overflowy Title: Admin account hijacking vulnerability Dork: inurl:"index.php?a=" Requirements: Default admin recovery functions enabled... Knowledge of the admin account email P.O.C Its possible for an attacker ...
CubeCart 3.x - Remote File Upload Vulnerability
No description provided by source...
CubeCart 3.0.x admin/print_order.php order_id Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied...
CubeCart 3.0.x /admin/print_order.php order_id Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied...
CubeCart <= 3.0.11 (oid) Remote Blind SQL Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' -------------------------------------------------------------------------------- CubeCart = 3.0.11 oid blind SQL injection / admin credentials disclosure exploit by rgod [email protected] site:...
Brooky CubeCart 2.0.1 - SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11337/info It is reported that CubeCart is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI data prior to including it in an SQL query...
Brooky CubeCart 2.0.1/2.0.4 index.php language Parameter Traversal Arbitrary File Access
No description provided by source. source: http://www.securityfocus.com/bid/12549/info Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out...
CubeCart 2.0.1 - SQL Injection Vulnerability
No description provided by source. =================================================================== CubeCart 2.0.1 SqL InjECti0N =================================================================== My + Author : XAviaTiqueX fr0m OS-TEAM Contact : [email protected] + Greats T0: YasMouh , M.K , ArGon...
CubeCart 3.0.6 - CSRF Vulnerability (Add Admin)
No description provided by source. Title : CubeCart 3.0.4 = CSRF Add Admin Script : CubeCart 3.0.4 Language : Php Download : http://www.cubecart.com/ Date : 2010/12/24 Version : 3.0.4 Dork : Powered by CubeCart 3.0.4 Found : by P0C T34M tnt-r00t Homepage : www.p0c.cc form name=p0c...