CVE-2005-0898

CVE-2005-0898 describes a cross-site scripting (XSS) vulnerability in the PHP file downloadform.php of the E-Store Kit-2 PayPal Edition. The flaw allows remote attackers to inject arbitrary web script or HTML by supplying a crafted txn_id parameter, potentially impacting users who view the affect...

CVE-2005-0897: Undefined Security Weakness

PHP remote file inclusion vulnerability in catalog.php in E-Store Kit-2 PayPal Edition allows remote attackers to execute arbitrary PHP code by modifying the menu and main parameters to reference a URL on a remote web server that contains the code...

CVE-2005-0898: Undefined Security Weakness

Cross-site scripting XSS vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txnid parameter...

File inclusion and XSS vulnerability in E-Store Kit-2 PayPal Edition

Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: High Title: File inclusion and XSS vulnerability in E-Store Kit-2 PayPal Edition Date: March 26, 2005 Summary: There are file include and xss vulnerabilities in E-Store Kit-2 PayPal Edition...

CVE-2005-0898

Cross-site scripting XSS vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txnid parameter...

MagicScripts E-Store Kit-2 PayPal Edition - Remote File Inclusion

MagicScripts E-Store Kit-2 PayPal Edition - Remote File Inclusion source: https://www.securityfocus.com/bid/12910/info MagicScripts E-Store Kit-2 PayPal Edition is prone to a remote file include vulnerability. Remote attackers could potentially exploit this issue to include a remote malicious PHP...

MagicScripts E-Store Kit-2 PayPal Edition - Cross-Site Scripting

MagicScripts E-Store Kit-2 PayPal Edition - Cross-Site Scripting source: https://www.securityfocus.com/bid/12909/info MagicScripts E-Store Kit-2 PayPal Edition is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code executed in the brows...

dcrab-estore.txt

This is a multi-part message in MIME format. ------=NextPart000000501C531B2.E030A030 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab...

CVE-2004-0301

Cross-site scripting XSS vulnerability in more.php for Online Store Kit 3.0 allows remote attackers to inject arbitrary HTML via the id parameter...

CVE-2004-0300

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via 1 the cat parameter in shop.php, 2 the id parameter in more.php, 3 the catmanufacturer parameter in shopbybrand.php, or 4 the id parameter in listing.php...

CVE-2004-0300

The CVE-2004-0300 entry concerns Ecommerce Corporation Online Store Kit 3.0. The vulnerability is a SQL injection in multiple parameters: cat in shop.php, id in more.php, cat_manufacturer in shop_by_brand.php, and id in listing.php. This allows remote attackers to inject arbitrary SQL and gain un...

CVE-2004-0301

CVE-2004-0301 is an XSS vulnerability in Online Store Kit 3.0, specifically in more.php via the id parameter. The root cause is insufficient input sanitization of the id value, allowing remote attackers to inject arbitrary HTML. Impact is described as partial confidentiality, integrity, and avail...

CVE-2004-0300

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via 1 the cat parameter in shop.php, 2 the id parameter in more.php, 3 the catmanufacturer parameter in shopbybrand.php, or 4 the id parameter in listing.php...

CVE-2004-0301

Cross-site scripting XSS vulnerability in more.php for Online Store Kit 3.0 allows remote attackers to inject arbitrary HTML via the id parameter...

CVE-2004-0301: Undefined Security Weakness

Cross-site scripting XSS vulnerability in more.php for Online Store Kit 3.0 allows remote attackers to inject arbitrary HTML via the id parameter...

CVE-2004-0300: Undefined Security Weakness

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via 1 the cat parameter in shop.php, 2 the id parameter in more.php, 3 the catmanufacturer parameter in shopbybrand.php, or 4 the id parameter in listing.php...

ZH2004-07SA.txt

ZH2004-07SA security advisory: Multiple Sql injection vulnerabilities in Online Store Kit 3.0 Products Lite - Standard and Pro Published: 17 february 2004 Released: 17 february 2004 Name: Online Store Kit Products Lite - Standard - Pro Affected Systems: 3.0 Issue: Sql Injection Vulnerability...

eCommerce Corporation Online Store Kit 3.0 - shop_by_brand.php?cat_manufacturer SQL Injection

eCommerce Corporation Online Store Kit 3.0 - shopbybrand.php?catmanufacturer SQL Injection source: https://www.securityfocus.com/bid/9687/info It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of...

ZH2004-07SA (security advisory): Multiple Sql injection vulnerabilities in Online Store Kit 3.0 Products (Lite - Standard and Pro)

ZH2004-07SA security advisory: Multiple Sql injection vulnerabilities in Online Store Kit 3.0 Products Lite - Standard and Pro Published: 17 february 2004 Released: 17 february 2004 Name: Online Store Kit Products Lite - Standard - Pro Affected Systems: 3.0 Issue: Sql Injection Vulnerability...

eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection

source: https://www.securityfocus.com/bid/9687/info It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI. As a result of this a malicious user may influence database...