Insulin Pump Hack Garners Federal Attention

The hack of a commercially available insulin pump earlier this month at the DEFCON hacker conference has attracted the attention of members of the House Energy & Commerce Committee, which is now calling for a formal review of wireless medical devices like the pump. Senior Committee members Anna G...

TotalShopUK 1.7.2 SQL Injection

Exploit Title: TotalShopUK E-Commerce System SQL Injection Date: 19.08.2011 Author: Eyup CELIK Software Link: http://www.totalshopuk.com Version: 1.7.2 Tested on: All versions are Vulnerability ISSUE SQL Injection can be done using the command input Exploit: products/c/index.php/1' Demo:...

Axis Commerce 0.8.1 Cross Site Scripting

Exploit Title: Axis Commerce E-Commerce System Stored XSS Date: 19.08.2011 Author: Eyup CELIK Software Link: https://github.com/downloads/axis/axiscommerce/axis-0.8.1.zip Version: 0.8.1 and previus Tested on: Apache For Windows ISSUE Vulnerable Modules = Search Module XSS can be done using the...

WordPress WP e-Commerce Plugin 'cart_messages' Parameter Cross-site Scripting Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

How Facebook and Facial Recognition Are Creating a Minority Report-Style Privacy Meltdown

Researchers at the annual Black Hat Briefings in Las Vegas have demonstrated how cloud computing, facial recognition technology, Facebook, a freely available personal information can be used to match faces in a crowd to detailed online profiles. The demonstration brings us closer to the brink of ...

WordPress E-commerce Plugin <= 3.8.4 - SQL Injection Exploit

The plugin is prone to an SQL Injection Exploit. This code of this vulnerability has been released under the authorization of GetShopped staff. It shows userlogin and userpass of wpusers table. Solution Update the plugin...

WordPress Plugin E-Commerce 3.8.4 - SQL Injection

WordPress Plugin E-Commerce 3.8.4 - SQL Injection Exploit Title: WP E-commerce plugin $value $formsql = "SELECT FROM " . WPSCTABLECHECKOUTFORMS . " WHERE id = '$valueid' LIMIT 1"; $formdata = $wpdb-getrow $formsql, ARRAYA ; FIX: Upgrade to version 3.8.5 Bug found by: IHTeam For GetShopped as thei...

WP E-commerce plugin <= 3.8.4 SQL Injection Exploit

Exploit for php platform in category web applications Exploit Title: WP E-commerce plugin $value $formsql = "SELECT FROM " . WPSCTABLECHECKOUTFORMS . " WHERE id = '$valueid' LIMIT 1"; $formdata = $wpdb-getrow $formsql, ARRAYA ; FIX: Upgrade to version 3.8.5 Bug found by: IHTeam Simone R00TATI...

XSS in WP e-Commerce

Vulnerability ID: HTB23031 Reference: http://www.htbridge.ch/advisory/xssinwpecommerce.html Product: WP e-Commerce Vendor: Instinct Entertainment http://getshopped.org/ Vulnerable Version: 3.8.5 and probably prior Tested on: 3.8.5 Vendor Notification: 13 July 2011 Vulnerability Type: XSS Cross Si...

WordPress Plugin E-Commerce 3.8.4 - SQL Injection

Exploit Title: WP E-commerce plugin $value $formsql = "SELECT FROM " . WPSCTABLECHECKOUTFORMS . " WHERE id = '$valueid' LIMIT 1"; $formdata = $wpdb-getrow $formsql, ARRAYA ; FIX: Upgrade to version 3.8.5 Bug found by: IHTeam For GetShopped as their security auditors This code has been released...

WordPress Plugin WP E-Commerce 3.8.6 - cart_messages[] Cross-Site Scripting

WordPress Plugin WP E-Commerce 3.8.6 - cartmessages Cross-Site Scripting source: https://www.securityfocus.com/bid/49009/info The WP e-Commerce plug-in for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverag...

WordPress WP e-Commerce Plugin 3.8.6 - Cross Site Scripting

WordPress WP e-Commerce plugin's "cartmessages" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...

WordPress e-Commerce 3.8.5 Cross Site Scripting

Vulnerability ID: HTB23031 Reference: http://www.htbridge.ch/advisory/xssinwpecommerce.html Product: WP e-Commerce Vendor: Instinct Entertainment http://getshopped.org/ Vulnerable Version: 3.8.5 and probably prior Tested on: 3.8.5 Vendor Notification: 13 July 2011 Vulnerability Type: XSS Cross Si...

WordPress Plugin WP E-Commerce 3.8.6 - 'cart_messages[]' Cross-Site Scripting

source: https://www.securityfocus.com/bid/49009/info The WP e-Commerce plug-in for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

90000 web pages infected by mass iFrame attack

90000 web pages infected by mass iFrame attack Security Experts Wayne Huang, Chris Hsiao, NightCola Lin discovered that more than 90000 web pages are infected by mass iFrame attack. There's been a mass scale injection ongoing recently, with the injected iframe pointing to willysy.com . Just Try a...

90000 web pages infected by mass iFrame attack

90000 web pages infected by mass iFrame attack Security Experts Wayne Huang, Chris Hsiao, NightCola Lin discovered that more than 90000 web pages are infected by mass iFrame attack. There's been a mass scale injection ongoing recently, with the injected iframe pointing to willysy.com . Just Try a...

Joomla VirtualMoney SQL Injection

Joomla Component virtualmoney SQL Injection Vulnerability Author : Fl0riX Bug Researchers Name : Joomla comvirtualmoney info : http://extensions.joomla.org/extensions/e-commerce/paid-membership-a-subscriptions/17714 Bug Type : SQL injection Infection : Admin Login Bilgileri Alinabilir. Example : ...

WordPress e-Commerce 3.8.4 SQL Injection

Original Advisory: http://www.ihteam.net/advisory/wordpress-wp-e-commerce-plugin/ Plain text here: http://www.ihteam.net/advisories/561684984189wp-e-commerce384sqli.tar.gz $value $formsql = "SELECT FROM " . WPSCTABLECHECKOUTFORMS . " WHERE id = '$valueid' LIMIT 1?; $formdata = $wpdb-getrow...

Cross-site Scripting (XSS) Vulnerability in WP e-Commerce

High-Tech Bridge SA Security Research Lab has discovered vulnerability in WP e-Commerce, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in WP e-Commerce Input passed via the cartmessages parameter to...

eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities

Document Title: =============== eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities Release Date: ============= 2011-07-13 Vulnerability Laboratory ID VL-ID: ==================================== 82 Product & Service Introduction: =============================== eclime is a very powerful...