EC-CUBE 2.12.6 - Server-Side Request Forgery

EC-CUBE 2.12.6 - Server-Side Request Forgery Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...

EC-CUBE 2.12.6 Server-Side Request Forgery

Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...

EC-CUBE 2.12.6 - Server-Side Request Forgery

Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...

CVE-2016-4837

SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-4837

SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-4837

The CVE-2016-4837 issue affects the EC-CUBE ecosystem: the Seed Coupon plugin (Coupon Plugin) is vulnerable to SQL injection (CWE-89) in versions before 1.6. The underlying flaw allows a remote attacker to manipulate or access database data via unspecified vectors. Impact is high, with potential ...

CVE-2016-4837

SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

EC-CUBE Coupon Plugin SQL Injection Vulnerability

LOCKON EC-CUBE is a set of open source e-commerce website building platform. coupon is one of the discount coupon plugin. LOCKON EC-CUBE Coupon suffers from a SQL injection vulnerability that can be exploited by remote attackers to submit specially crafted SQL queries to manipulate or obtain...

EC-CUBE plugin "Coupon Plugin" vulnerable to SQL injection

Overview EC-CUBE plugin "Coupon Plugin" provided by Seed Inc. contains an SQL injection vulnerability CWE-89. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

JVN#40696431: EC-CUBE plugin "Coupon Plugin" vulnerable to SQL injection

EC-CUBE plugin "Coupon Plugin" provided by Seed Inc. contains an SQL injection vulnerability CWE-89. Impact Information stored in the database may be obtained or altered by a remote attacker. Solution Update the plugin Update to the latest version according to the information provided by the...

CVE-2016-1201

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

CVE-2016-1201

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

Design/Logic Flaw

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1200

The CVE-2016-1200 entry affects LOCKON EC-CUBE 3.0.7–3.0.9. The vulnerability is described as a bypass of intended access restrictions on the management screen by remote authenticated users, via unspecified vectors (a distinct issue from CVE-2016-1199). Connected documents confirm the affected pr...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...