JVN#34900750: EC-CUBE vulnerable to code injection

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a code injection vulnerability. Impact Arbitrary PHP code may be executed with the privilege of the application on the server where it resides. Solution Apply the update or patch Apply the updat...

JVN#07192063: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN98665228. Impact An arbitrary script may be executed on the user's web browser. Solution Apply the update ...

JVN#04161229: EC-CUBE vulnerable to directory traversal

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability. Note that this vulnerability is different from JVN43886811. Impact A remote attacker may obtain arbitrary image files on the server. Solution Apply the updat...

JVN#43886811: EC-CUBE vulnerable to directory traversal

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability. Note that this vulnerability is different from JVN04161229. Impact A remote attacker may obtain arbitrary image files on the server. Solution Apply the updat...

JVN#98665228: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN07192063. Impact An arbitrary script may be executed on the user's web browser. Solution Apply the update ...

CVE-2013-2314

Cross-site scripting XSS vulnerability in the adminAuthorization function in data/class/helper/SCHelperSession.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the management screen...

CVE-2013-2313

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2312

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2315

data/class/pages/forgot/LCPageForgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request...

Cross site scripting

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Session fixation

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2312

The CVE affects EC-CUBE (LOCKON) shopping-cart: XSS via crafted URL in EC-CUBE 2.11.0–2.12.3enP2 caused by improper handling/output of parameters. Impact is arbitrary script execution in the user’s browser when a cart item is present. Remediation: apply the vendor patch/update (per JVN entries li...

CVE-2013-2314

CVE-2013-2314 affects EC-CUBE 2.11.0–2.12.3enP2. The vulnerability is a cross-site scripting (XSS) in the adminAuthorization function within SC_Helper_Session.php, allowing a remote attacker to inject arbitrary script/HTML via a crafted URL used on the management screen. Root cause: improper hand...

CVE-2013-2312

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2313

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2315

data/class/pages/forgot/LCPageForgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-2315

EC-CUBE v2.11.0–v2.12.3enP2 suffers an information disclosure vulnerability due to improper input validation in LC_Page_Forgot.php’s password reminder flow. A remote, unauthenticated attacker can craft a request that triggers leakage of sensitive data. The issue is documented across multiple sour...

CVE-2013-2313

CVE-2013-2313 refers to a session fixation vulnerability in LOCKON EC-CUBE, affecting EC-CUBE versions 2.11.0 through 2.12.3enP2. The underlying issue allows a remote attacker to hijack a user session, potentially leading to impersonation and unauthorized access or data modification. Public docum...

EC-CUBE vulnerable to information disclosure as a result of improper input checking

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue with checking input values, which may result in information disclosure. LOCKON CO.,LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

EC-CUBE fails to restrict access permissions

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a URL handling issue in certain environments and as a result, access permissions are not restricted. Gen Sato reported this vulnerability to IPA. JPCERT/CC coordinated with the develope...