midicartInject.txt

Hello All, I have discovered a number of remote vulnerabilities in: MidiCart ASP Shopping Cart, Evaluation Version 7 & Standard & Pro Authors Site: http://www.midicart.com/ +-Examples:--------------------------------------------------+ 1------------------------------------------------------------...

CVE-2005-2601

SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the codeno parameter to 1 ItemShow.asp or 2 searchlist.asp...

CVE-2005-2601

SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the codeno parameter to 1 ItemShow.asp or 2 searchlist.asp...

CVE-2005-2601

CVE-2005-2601 describes an SQL injection in MidiCart (ASP Shopping Cart). The vulnerability allows remote attackers to issue arbitrary SQL via the code_no parameter to Item_Show.asp or search_list.asp. This is a server-side data handling flaw that can impact confidentiality, integrity and availab...

Hackgen Security Advisory 2005.4

http://www.hackgen.org/advisories/hackgen-2005-004.txt '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' hackgen-2005-004 ' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' Multiple bugs in MidiCart PHP Shopping Cart '...

CVE-2002-1798

MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to 1 upload arbitrary php files via a direct request to admin/upload.php or 2 access sensitive information via a direct request to admin/creditcardinfo.php...

CVE-2002-1798

In MidiCart PHP, PHP Plus, and PHP Maxi, a vulnerability allows remote attackers to upload arbitrary PHP files via a direct request to admin/upload.php or to access sensitive information via admin/credit_card_info.php. Connected PT-2002-2520 provides mitigation guidance to disable or restrict acc...

CVE-2005-1503

Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 searchstring parameter to searchlist.php, the 2 maingroup or 3 secondgroup parameters to itemlist.php, or 4 codeno parameter to itemshow.php...

CVE-2005-1502

Cross-site scripting XSS vulnerability in MidiCart PHP Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the 1 searchstring parameter to searchlist.php or the 2 secondgroup or 3 maingroup parameters to itemlist.php...

CVE-2005-1503

Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the 1 searchstring parameter to searchlist.php, the 2 maingroup or 3 secondgroup parameters to itemlist.php, or 4 codeno parameter to itemshow.php...

CVE-2005-1501

MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to 1 searchlist.php, 2 itemlist.php, or 3 itemshow.php, which reveal the path in a PHP error message...

CVE-2005-1502

The CVE-2005-1502 entry describes a cross-site scripting (XSS) vulnerability in MidiCart PHP Shopping Cart. The affected components are the search_list.php script (parameter: searchstring) and item_list.php (parameters: secondgroup, maingroup). The core issue is the ability for remote attackers t...

CVE-2005-1502

Cross-site scripting XSS vulnerability in MidiCart PHP Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the 1 searchstring parameter to searchlist.php or the 2 secondgroup or 3 maingroup parameters to itemlist.php...

CVE-2005-1501

Vulnerability summary for CVE-2005-1501: MidiCart PHP Shopping Cart allows remote attackers to disclose sensitive information by directly requesting one of three PHP pages (search_list.php, item_list.php, item_show.php). The root cause is that these requests reveal the path in a PHP error message...

CVE-2005-1501

MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to 1 searchlist.php, 2 itemlist.php, or 3 itemshow.php, which reveal the path in a PHP error message...

CVE-2005-1503

CVE-2005-1503 affects MidiCart PHP Shopping Cart. The issue comprises multiple SQL injection vulnerabilities exploitable via parameters in search_list.php (searchstring), item_list.php (maingroup, secondgroup), and item_show.php (code_no). Successful exploitation allows remote execution of arbitr...

[hackgen-2005-#004] - Multiple bugs in MidiCart PHP Shopping Cart

http://www.hackgen.org/advisories/hackgen-2005-004.txt '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' hackgen-2005-004 ' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' Multiple bugs in MidiCart PHP Shopping Cart '...

MidiCart PHP - Item_List.php?SecondGroup Cross-Site Scripting

MidiCart PHP - ItemList.php?SecondGroup Cross-Site Scripting source: https://www.securityfocus.com/bid/13517/info MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage thi...

MidiCart PHP - 'Item_List.php?SecondGroup' SQL Injection

source: https://www.securityfocus.com/bid/13514/info MidiCart PHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or modify data...

MidiCart PHP - 'Search_List.php?SearchString' Cross-Site Scripting

source: https://www.securityfocus.com/bid/13516/info MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser...