CVE-2006-1098

Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the 1 informationID or 2 ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that thi...

CVE-2006-1109

SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it is not clear whether this report is associated with a specific product. If not, then it should not be included in CVE...

CVE-2006-1098

NZ Ecommerce is affected by multiple SQL injection vulnerabilities exploitable via index.php with the informationID or ParentCategory parameters. The root cause is improper input handling that allows arbitrary SQL execution. Impact is remote compromise of the database as described in sources; exp...

CVE-2006-1096

CVE-2006-1096 affects NZ Ecommerce, specifically the XSS in index.php via the action parameter. The vulnerability is a stored/ reflected-type cross-site scripting issue that allows remote attackers to inject arbitrary script or HTML. The vendor’s dispute is noted in multiple sources; no concrete ...

CVE-2006-1098

Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the 1 informationID or 2 ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that thi...

CVE-2006-1109

SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it is not clear whether this report is associated with a specific product. If not, then it should not be included in CVE...

CVE-2006-1109

CVE-2006-1109: SQL injection vulnerability in index.asp of Total Ecommerce 1.0 via the id parameter allows remote arbitrary SQL execution. Root cause described as an injection vulnerability; exploitation details are not provided in the connected documents. No remediation steps, affected version i...

CVE-2006-1096

Cross-site scripting XSS vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate...

PT-2006-2123 · Nz · Nz Ecommerce

Name of the Vulnerable Software and Affected Versions: NZ Ecommerce affected versions not specified Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the action parameter in index.php. The vendor has disputed this issue, but research...

NZ eCommerce System - index.php Multiple SQL Injections

NZ eCommerce System - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/16931/info NZ Ecommerce is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. A successful exploit could...

NZ Ecommerce SQL&XSS vuln.

Vuln. discovered by : r0t Date: 2 march 2006 vendor: www.digitalbuilder.co.nz/ProductCodeNZEcommerce.asp affected version: latest Orginal advisory: http://pridels.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html 1.XSS Input passed to the "action" parameter in "index.php" isn't properly sanitise...

NZ eCommerce System - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/16931/info NZ Ecommerce is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the application, access o...

CVE-2006-0874

Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes". NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue from January 8, 2005 is too vague to be sure,...

Information disclosure

Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes". NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue from January 8, 2005 is too vague to be sure,...

CVE-2006-0874

Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes". NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue from January 8, 2005 is too vague to be sure,...

CVE-2006-0874

CVE-2006-0874 relates to Intensive Point iUser Ecommerce prior to 2.2, with multiple unspecified vulnerabilities addressed by urgent fixes. Connected sources provide concrete detail for CVE-2006-0854 (a likely related entry): PHP remote file inclusion in common.php that lets remote attackers incl...

[SA18903] iUser Ecommerce common.php File Inclusion Vulnerability

TITLE: iUser Ecommerce common.php File Inclusion Vulnerability SECUNIA ADVISORY ID: SA18903 VERIFY ADVISORY: http://secunia.com/advisories/18903/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: iUser Ecommerce 2.x http://secunia.com/product/8175/ DESCRIPTION: ReZEN ha...

PT-2006-1920 · Intensive Point · Intensive Point Iuser Ecommerce

Name of the Vulnerable Software and Affected Versions: Intensive Point iUser Ecommerce versions prior to 2.2 Description: The issue involves multiple unspecified vulnerabilities with unspecified vectors and impact. These vulnerabilities have been addressed by urgent secure fixes. Recommendations:...

[SA19003] iUser Ecommerce Unspecified Vulnerabilities

TITLE: iUser Ecommerce Unspecified Vulnerabilities SECUNIA ADVISORY ID: SA19003 VERIFY ADVISORY: http://secunia.com/advisories/19003/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote SOFTWARE: iUser Ecommerce 2.x http://secunia.com/product/8175/ DESCRIPTION: Some vulnerabilities...

CVE-2006-0854

PHP remote file inclusion vulnerability in common.php in Intensive Point iUser Ecommerce allows remote attackers to include arbitrary files via a URL in the includepath variable, which is not initialized before being used...