ShopEx 4.8.5 /core/api/shipping/pim/3.1/api_pim_3_1_goods.php columns SQL注入漏洞

No description provided by source...

Threat Outbreak Alert: Fake Shipping and Handling Inquiry Email Messages on July 22, 2013

Medium Alert ID: 30164 First Published: 2013 July 22 16:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an order inquiry for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Shipping Invoice Notification Email Messages on July 14, 2013

Medium Alert ID: 30084 First Published: 2013 July 15 18:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a shipping invoice notification for the recipient. The text in the email message attempts to convince the recipie...

Threat Outbreak Alert: Fake Shipping and Handling Advice Request Email Messages on July 1, 2013

Medium Alert ID: 29869 First Published: 2013 July 1 17:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an inquiry for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Shipping Document Email Messages on June 26, 2013

Low Alert ID: 29814 First Published: 2013 June 27 13:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment of shipping documents for the recipient. The text in the email message attempts to persuade the...

Threat Outbreak Alert: Fake Shipping Manifest Document Email Messages on June 25, 2013

Medium Alert ID: 29799 First Published: 2013 June 26 14:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment of shipping documents for the recipient. The text in the email message attempts to persuade the...

CVE-2013-1465

The Cubecart::basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object...

Code injection

The Cubecart::basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object...

PT-2013-3150 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions 5.0.0 through 5.2.0 Description: The issue allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter. This can be used to modify the application configuration using the Config object...

CubeCart 5.2.0 PHP Object Injection

------------------------------------------------------------------------- CubeCart set'shipping', unserializebase64urldecode$POST'shipping'; 522. if !isset$POST'proceed' 523. httpredircurrentPage; 524. 525. User input passed through the $POST'shipping' parameter is not properly sanitized before...

ecshop all version injection analysis-vulnerability warning-the black bar safety net

Some time ago, probably 2 0 1 2 Christmas around the t00ls saw ecshop all version injection, then also downloaded the latest program analysis,recent exam is busy, just today I put my analysis of the recorded. Vulnerability key file: /includes/liborder.php Key functions: | 0 1 | function...

ShopEx4. 8 5 vulnerability the shipping address can be any view modify delete a-vulnerability warning-the black bar safety net

Ordinary members, after logging in, by a maliciously constructed URL can be achieved for the entire site shipping address to view, modify, and delete. Causing the user sensitive privacy leak and website, unnecessary losses. Detailed description: core/shop/controller/ctl. member. php file //Modify...

Threat Outbreak Alert: Fake Portuguese Pornographic Video Email Messages on April 22, 2014

Medium Alert ID: 26252 First Published: 2012 June 26 21:46 GMT Last Updated: 2014 April 23 14:15 GMT Version: 3 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain an attachment to a pornographic video file for the...

osCmax Shop CMS v2.5.1 - Multiple Web Vulnerabilities

Title: ====== osCmax Shop CMS v2.5.1 - Multiple Web Vulnerabilities Date: ===== 2012-04-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=497 VL-ID: ===== 497 Introduction: ============= osCMax is a powerful e-commerce/shopping cart web application. There are many...

Directory traversal

Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 set or 2 module parameter to a OM/Core/Site/Admin/Application/templatesmodules/pages/info.php, b...

Anonymous Shifts Attention to Big Oil, Monsanto

Just days after infiltrating military contractor Booz Allen Hamilton, hacktivist group Anonymous has confirmed they’ve set their next target: Big oil. In a post on the AnonNews website, the group has announced their intent to shift their ongoing Operation Green Rights initiative to “protest...

eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities

Document Title: =============== eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities Release Date: ============= 2011-07-13 Vulnerability Laboratory ID VL-ID: ==================================== 82 Product & Service Introduction: =============================== eclime is a very powerful...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the 1 billing address or 2 shipping address...

Fake Amazon Shipping Notice Hides Trojan

The image of an open Amazon delivery box has a prominent place in the latest spam campaign that aims to trick users into downloading an alleged order update coming from the dot com giant. Read the full article. Help Net Security...

Design/Logic Flaw

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...