CVE-2006-5960

CVE-2006-5960 concerns XSS vulnerabilities in A+ Store E-Commerce, specifically in account_login.asp. The issue allows remote attackers to inject arbitrary script/HTML via the username (txtUserName) and password (txtPassword) parameters. The vulnerability affects the login page’s input handling a...

CVE-2006-5959: Undefined Security Weakness

SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter...

ecomkit1.txt

vendor site:http://www.sitesoutlet.com/ product:E-commerce Kit 1 PayPal Edition bug:injection sql risk:medium injection sql : http://site.com/PATH/catalogue.asp?keyword='sql http://site.com/PATH/catalogue.asp?cid='sql http://site.com/PATH//viewDetail.asp?pid='sql laurent gaffié & benjamin mossé...

ASPintranet SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/ecommercekit.txt ----------------------------------------------------------- Software: UStore | E-Commerce Kit 2 Vendor: http://www.sitesoutlet.com...

CVE-2006-5960: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in accountlogin.asp in A+ Store E-Commerce allow remote attackers to inject arbitrary web script or HTML via the 1 username txtUserName and 2 password txtPassword parameters. NOTE: portions of these details are obtained from third party informatio...

CVE-2006-5936

SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter...

astoreecom.txt

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username = '"alertdocument.cookie'"alertdocument.cookie passwd =...

E-commerce Kit 1 PayPal Edition [ injection sql ]

vendor site:http://www.sitesoutlet.com/ product:E-commerce Kit 1 PayPal Edition bug:injection sql risk:medium injection sql : http://site.com/PATH/catalogue.asp?keyword='sql http://site.com/PATH/catalogue.asp?cid='sql http://site.com/PATH//viewDetail.asp?pid='sql laurent gaffie & benjamin mosse...

eShopping SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/ecommercestore.txt ----------------------------------------------------------- Software: E Commerce Store Shop Builder Method : SQL Injection PoC:...

CVE-2006-5936

CVE-2006-5936 describes an SQL injection in dept.asp of the SiteXpress E-Commerce System, exploitable via the id parameter to allow remote execution of arbitrary SQL commands. Affected component: dept.asp in SiteXpress E-Commerce System. Root cause: improper handling of the id parameter leading t...

Ustore SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/UStore.txt ----------------------------------------------------------- Software: UStore | E-Commerce in 15-Minutes Method : Sql Injection PoC:...

CVE-2006-5936: Undefined Security Weakness

SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter...

ecommercestore.txt

Aria-Security Team Advisory Original Advisory : http://aria-security.net/advisory/ecommercestore.txt ----------------------------------------------------------- Software: E Commerce Store Shop Builder Method : SQL Injection PoC:...

A+ Store E-Commerce[ injection sql & xss (post) ]

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username =...

CVE-2006-5936

SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter...

sitexpress.txt

Aria-Security Team Advisory Original Advisory : http://aria-security.net/advisory/SiteXpress.txt ----------------------------------------------------------- Software: SiteXpress E-Commerce System Method : SQL Injection PoC: http://target/path/ http://target/path/dept.asp?id=SQL Contact:...

SiteXpress E-Commerce System - Dept.asp SQL Injection

SiteXpress E-Commerce System - Dept.asp SQL Injection source: https://www.securityfocus.com/bid/21059/info SiteXpress E-Commerce System is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful...

SiteXpress E-Commerce System - 'Dept.asp' SQL Injection

source: https://www.securityfocus.com/bid/21059/info SiteXpress E-Commerce System is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

SiteXpress SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/SiteXpress.txt ----------------------------------------------------------- Software: SiteXpress E-Commerce System Method : SQL Injection PoC:...

SiteXpress SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/SiteXpress.txt ----------------------------------------------------------- Software: SiteXpress E-Commerce System Method : SQL Injection PoC:...