CubeCart includes/content/viewProd.inc.php productId Parameter SQL Injection

The version of CubeCart running on the remote host has a SQL injection vulnerability. Input to the 'productId' parameter of is not properly sanitized in 'includes/content/viewProd.inc.php' before it is used in database queries. Regardless of PHP's 'magicquotesgpc' setting, a remote attacker could...

CubeCart 'productId' SQL Injection Vulnerability

CubeCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CubeCart 3.0.44.3.6 - ProductID SQL Injection

CubeCart 3.0.44.3.6 - ProductID SQL Injection source: https://www.securityfocus.com/bid/37065/info CubeCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

CubeCart 3.0.4/4.3.6 - 'ProductID' SQL Injection

source: https://www.securityfocus.com/bid/37065/info CubeCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...

CVE-2009-3904

classes/session/ccadminsession.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty 1 sessID ccAdmin cookie, 2 XCLUSTERCLIENTIP header, or 3...

Design/Logic Flaw

classes/session/ccadminsession.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty 1 sessID ccAdmin cookie, 2 XCLUSTERCLIENTIP header, or 3...

CVE-2009-3904

CVE-2009-3904 affects CubeCart 4.3.4 where session management does not properly restrict administrative access, allowing a remote attacker to bypass admin permissions and gain administrative access via a crafted HTTP request containing an empty sessID cookie, an empty X_CLUSTER_CLIENT_IP header, ...

CVE-2009-3904

classes/session/ccadminsession.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty 1 sessID ccAdmin cookie, 2 XCLUSTERCLIENTIP header, or 3...

CubeCart 'admin.php' Authentication Bypass Information Disclosure

The version of CubeCart running on the remote host has an authentication bypass vulnerability that could lead to information disclosure. Sending a specially crafted POST request for admin.php bypasses authentication for the administrative user, revealing information such as CubeCart version, PHP...

CubeCart Admin Authentication Bypass

The version of CubeCart running on the remote host has an authentication bypass vulnerability. Sending a specially crafted POST request for 'admin.php' bypasses authentication for the administrative user. A remote attacker could exploit this to perform administrative actions such as installing...

CubeCart 4 Session Management Bypass

No description provided by source. CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software...

CubeCart 4 Session Management Bypass

CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software solution, designed to allow individuals...

CubeCart 4 Session Management Bypass

Exploit for unknown platform in category web applications ==================================== CubeCart 4 Session Management Bypass ==================================== CubeCart 4 Session Management Bypass Severity: Critical Vendor Status: Vendor has released an updated version I. Background From...

CubeCart 4 - Session Management Bypass

CubeCart 4 - Session Management Bypass CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software...

CubeCart 4 Session Management Bypass

CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software solution, designed to allow individuals...

CubeCart 4 - Session Management Bypass

CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software solution, designed to allow individuals...

CubeCart Detection (HTTP)

HTTP based detection of CubeCart. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.900614";...

cubecartcms-sql.txt

; Greetings to --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - P4tr1ck and all darkc0de members ; Author: swappie aka faithlove Email : [email protected] Do researching and share! ; Title: CubeCart CMS Sql Injection Vendor: http://www.cubecart.com/ ; Dork:...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via 1 the a parameter in a searchStr action and the 2 Submit parameter...

CVE-2008-1550

Multiple cross-site scripting XSS vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via 1 the a parameter in a searchStr action and the 2 Submit parameter...