622 matches found
NSA Group Security Advisory NSAG-№197-23.02.2006 Vulnerability CubeCart 3.0.0 – 3.0.6
Advisory: NSAG-№197-23.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: CubeCart 3.0.0 – 3.0.6 Site of manufacturer: http://www.cubecart.com The status: 19/11/2005 - Publication is postponed...
Brooky CubeCart < 3.0.7 connector.php Arbitrary File Upload
Binary data 3446.prm...
CubeCart 3.0.x - Arbitrary File Upload
CubeCart 3.0.x - Arbitrary File Upload source: https://www.securityfocus.com/bid/16796/info CubeCart is prone to an arbitrary file-upload vulnerability. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate...
CubeCart 3.0.x - Arbitrary File Upload
source: https://www.securityfocus.com/bid/16796/info CubeCart is prone to an arbitrary file-upload vulnerability. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege...
cubecartXSS.txt
CubeCart 3.0.7-pl1 multiple variable Cross site scripting Vendor url: www.cubecart.com bug report:http://bugs.cubecart.com/?do=details&id=459 Advisore:http://lostmon.blogspot.com/2006/01/ cubecart-307-pl1-indexphp-multiple.html. vendor notify:yes exploit avalable: yes I recomended to all vendors ...
CVE-2006-0245
Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the 3 redir, 4 productId, 5 docId, 6 act, and 7 catId parameters in index.php; and the 8 username field in a login action in index.php. NOTE: the cart.php/redi...
CVE-2006-0245
CVE-2006-0245: CubeCart 3.0.7-pl1 is vulnerable to multiple cross-site scripting (XSS) flaws. Remote attackers can inject arbitrary script/HTML via index.php parameters (redir, productId, docId, act, catId) and the username field in a login action; the cart.php/redir and index.php/searchStr vecto...
CVE-2006-0245
Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the 3 redir, 4 productId, 5 docId, 6 act, and 7 catId parameters in index.php; and the 8 username field in a login action in index.php. NOTE: the cart.php/redi...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the 3 redir, 4 productId, 5 docId, 6 act, and 7 catId parameters in index.php; and the 8 username field in a login action in index.php. NOTE: the cart.php/redi...
[SA18519] CubeCart Cross-Site Scripting Vulnerabilities
TITLE: CubeCart Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA18519 VERIFY ADVISORY: http://secunia.com/advisories/18519/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: CubeCart 2.x http://secunia.com/product/4021/ CubeCart 3.x...
Input validation
PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the globrootDir parameter...
CVE-2006-0064
PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the globrootDir parameter...
CVE-2006-0064
PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the globrootDir parameter...
CVE-2006-0064
The CVE-2006-0064 entry concerns CubeCart. Multiple connected records confirm a PHP remote file inclusion vulnerability in includes/orderSuccess.inc.php, exploitable via a URL parameter glob[rootDir] that allows execution of arbitrary PHP code. This indicates a client-controllable file inclusion ...
cijfer-ccxpl.pl.txt
!/usr/bin/perl cijfer-ccxpl - CubeCart All rights reserved. 1. example cijfer@kalma:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d [email protected] /$ id;uname -a uid=48apache gid=48apache groups=48apache,2523psaserv Linux server.xxx.com 2.6.10-1.771FC2 1 Mon Mar 28 00:50:14 EST 2005 i686...
CubeCart 3.0.6 - Remote Command Execution
CubeCart 3.0.6 - Remote Command Execution !/usr/bin/perl cijfer-ccxpl - CubeCart All rights reserved. 1. example cijfer@kalma:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d [email protected] /$ id;uname -a uid=48apache gid=48apache groups=48apache,2523psaserv Linux server.xxx.com...
CubeCart <= 3.0.6 Remote Command Execution Exploit
Exploit for unknown platform in category web applications ================================================== CubeCart All rights reserved. 1. example email protected:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d email protected /$ id;uname -a uid=48apache gid=48apache...
CubeCart <= 3.0.6 Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl cijfer-ccxpl - CubeCart =3.0.6 Remote Command Execution Exploit Copyright c 2005 cijfer [email protected] All rights reserved. 1. example cijfer@kalma:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d [email protected] /$ id;uname -a uid=48apache...
CubeCart 3.0.6 - Remote Command Execution
!/usr/bin/perl cijfer-ccxpl - CubeCart All rights reserved. 1. example cijfer@kalma:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d [email protected] /$ id;uname -a uid=48apache gid=48apache groups=48apache,2523psaserv Linux server.xxx.com 2.6.10-1.771FC2 1 Mon Mar 28 00:50:14 EST 2005 i686...
Brooky CubeCart index.php language XSS
The remote host runs CubeCart, is an eCommerce script written with PHP & MySQL. This version is vulnerable to cross-site scripting and remote script injection due to a lack of sanitization of user-supplied data. Successful exploitation of this issue may allow an attacker to execute malicious scri...