PT-2017-14329

Name of the Vulnerable Software and Affected Versions Vastal I-Tech Dating Zone version 0.9.9 Description The issue allows SQL Injection via the product id variable in the "add to cart.php" endpoint. This enables potential attackers to inject malicious SQL code. Recommendations For version 0.9.9,...

CVE-2015-1178

Multiple cross-site scripting XSS vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 productid or 2 categoryid parameter...

CVE-2015-1178: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 productid or 2 categoryid parameter...

PT-2015-5148

Name of the Vulnerable Software and Affected Versions X-Cart versions 5.1.8 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the product id or category id parameter...

Open redirect

Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to 1 index.php, 2 cart.php, 3 msg.php, or 4 page.php...

CVE-2014-8306

CVE-2014-8306 affects C97net Cart Engine prior to 4.0. The vulnerability is a SQL injection in the sql_query function of cart.php exploited through the item_id parameter (item_id[0] or item_id[]), enabling remote command execution. Public references describe the vulnerable input handling but do n...

CVE-2014-8306

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

CVE-2014-8306: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

PT-2014-8455

Name of the Vulnerable Software and Affected Versions C97net Cart Engine versions prior to 4.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the item id variable in the sql query function in cart.php. The vulnerability can be exploited using...

Digishop 4.0 Cart.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20297/info digiSHOP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to have arbitrary script code execute in the browser of an...

CubeCart 3.0.3 cart.php redir Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/14962/info CubeCart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to...

WHMCS‘cart.php’拒绝服务漏洞

BUGTRAQ ID: 65470 WHMCS（WHM Complete Solution）是英国WHMCS公司的一套全面支持域名注册管理解析、主机开通管理、VPS开通管理和服务器管理的一站式主机管理软件。 WHMCS中存在拒绝服务漏洞。攻击者可利用该漏洞造成拒绝服务，拒绝服务合法用户。WHMCS 5.12版本中存在漏洞，其他版本也可能受到影响。 0 WHMCS 5.12 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.whmcs.com/ !/usr/bin/perl @@@ @@@@@@@@@@@ @@@@@...

PT-2011-5048

Name of the Vulnerable Software and Affected Versions osCSS2 versions 2.1.0 and earlier Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the ID parameter to either "catalog/shopping cart.php" or...

WHMCompleteSolution 'cart.php' Local File Disclosure Vulnerability

WHMCompleteSolution is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. Th...

Uiga Personal Portal - Multiple Vulnerabilities

Uiga Personal Portal - Multiple Vulnerabilities Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command...

Uiga Personal Portal Cross Site Scripting / Blind SQL Injection

Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command input Vulnerable Page: index.php cart.php...

WHMCompleteSolution (WHMCS) 3.x 4.0.x - cart.php Local File Disclosure

WHMCompleteSolution WHMCS 3.x 4.0.x - cart.php Local File Disclosure Title : WHMCompleteSolution cart.php Local File Disclosure Author : Lagripe-Dz Product : WHMCS WHMCompleteSolution Vendor : http://whmcs.com/ Date : 10/01/2011 Version : 3.x.x , 4.0.x Tested on : linux+apache...

Uiga Personal Portal Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the...

WHMCompleteSolution (cart.php) Local File Disclosure

Exploit for php platform in category web applications Title : WHMCompleteSolution cart.php Local File Disclosure Author : Lagripe-Dz Product : WHMCS WHMCompleteSolution Vendor : http://whmcs.com/ Date : 10/01/2011 Version : 3.x.x , 4.0.x Tested on : linux+apache...

Sabadkharid SQL Injection

Exploit Title: sabadkharid SQLinjection Vulnerabilities Google Dork: Powered by Parsp.com - Date: 2011-sep-22 Author: s1nahack3r E-Mail ; [email protected] £££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££££ / Sql Injection: http://Target/cart.php?shoppingcart&add2cart=1...