EUVD-2014-5038

Malware in sbrugna...

Sql injection

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...

CVE-2014-5140

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...

CVE-2014-5140

CVE-2014-5140 affects Loaded Commerce 7. The vulnerability is in the bindReplace function of the query factory (includes/classes/database.php), which does not properly handle colon characters. This enables SQL injection via the First name and Last name fields in the address book when used by remo...