Zen-Cart <= 1.2.6d blind SQL injection / remote commands execution:

Zen-Cart = 1.2.6d blind SQL injection / remote commands execution: software: site: http://www.zencart.com/ description:"Zen Cart™ truly is the art of e-commerce; a free, user-friendly, open source shopping cart system. The software is being developed by group of like-minded shop owners,...

Alisveristr E-Commerce Login - Multiple SQL Injections

Alisveristr E-Commerce Login - Multiple SQL Injections source: https://www.securityfocus.com/bid/15699/info Alisveristr E-commerce is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in a...

Alisveristr E-Commerce Login - Multiple SQL Injections

source: https://www.securityfocus.com/bid/15699/info Alisveristr E-commerce is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a...

Affcommerce Multiple Sql inj.

Affcommerce Multiple Sql inj. Vuln. dicovered by : r0t Date 23 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/affcommerce-multiple-sql-inj.html Vendor:http://www.affcommerce.com/ affected version:1.1.4 Product Description: Affcommerce is a unique, one of its kind affiliate based...

Commodity Rentals 2.x "user_id" Sql inj.

Vuln. dicovered by : r0t Date: 23 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/commodity-rentals-2x-userid-sql-inj.html Vendor:http://www.commodityrentals.com/ affected version: 2.x and prior Product Description: CommodityRentals is the most comprehensive Online Rental Business...

Midicart sql injection

Midicart sql injection ================== product descriptionfrom site:- ================== MidiCart is a Try-Before-You-Buy Shopping Cart Software, that provides all you need to create, operate, and maintain a professional Internet shop. MidiCart ASP and PHP Shopping Cart is extremely easy to us...

osCommerce directory traversal

The remote host is running osCommerce, a widely installed open source shopping e-commerce solution. The remote version of this software is vulnerable to a directory traversal flaw which may be exploited by an attacker to read arbitrary files on the remote server with the privileges of the web...

osCommerce Malformed Session ID XSS Vulnerability

osCommerce is an online shop e-commerce solution under on going development by the open source community. Its feature packed out-of-the-box installation allows store owners to setup, run, and maintain their online stores with minimum effort and with absolutely no costs or license fees involved...

CactuShop XSS and SQL injection flaws

The remote host runs CactuShop, an e-commerce web application written in ASP. The remote version of this software is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied data in the script 'popuplargeimage.asp'. Successful exploitation of this issue may allow an...

CactuShop XSS and SQL injection flaws

The remote host runs CactuShop, an e-commerce web application written in ASP. The remote version of this software is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied data in the script SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be...

Rich Media E-Commerce Stores Sensitive Information Insecurely

A security vulnerability in Rich Media SPDX-FileCopyrightText: 2002 SecurITeam Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10874";...

просмотр файлов в JShop Server 1.3.0

Здравствуйте, 3APA3A. вот нашел новый баг: Software: JShop Server 1.3.0 Vendor: JShop E-Commerce http://www.jshop.co.uk/ Vulnerability: возможность чтения файлов Risk: низкий Date: 30.09.2005 discovered by durito -duritoatmaildotru- HTTP: www.lwb57.org www.carder-world.ru IRC: irc.lwb57.org:6667...

mall23.txt

ORIGINAL LINK: http://systemsecure.org/ssforum/viewtopic.php?t=277 ------------------------------------- Ref: SS21092005 SYSTEMSECURE.ORG - Advisory/Exploit PUBLIC ADVISORY ------------------------------------- » Software: Mall23 » Link: http://www.mall23.com/ » Attacks: SQL Injection » Discovere...

CVE-2004-2275

The CVE-2004-2275 entry concerns i-mall.cgi in I-Mall Commerce, where remote command execution is possible via shell metacharacters in the p parameter. The vulnerability stems from insufficient input sanitization in i-mall.cgi, enabling an attacker to pass arbitrary shell commands to the remote s...

CVE-2004-2275

i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter...

CVE-2005-2221

Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the 1 key parameter to dcCategoriesview.asp, 2 dcproductslistClearance.asp, 3 PID parameter to ratings.asp, 4 dcProductsview.asp, 5 start, ...

CVE-2005-2220

Dragonfly Commerce (Dragonfly) is affected by a vulnerability where remote attackers can modify the hidden field x_DragonflyCartProductPrice to alter product prices via several endpoints (dc_Categorieslist.asp, dc_Categoriesview.asp, dc_productslist.asp, dc_productslist_Clearance.asp). The vendor...

CVE-2005-2220

Dragonfly Commerce allows remote attackers to change a product price by modifying the xDragonflyCartProductPrice hidden field to 1 dcCategorieslist.asp, 2 dcCategoriesview.asp, 3 dcproductslist.asp, and 4 dcproductslistClearance.asp. NOTE: the vendor has disputed this issue, saying that "Dragonfl...

CVE-2005-2221

Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the 1 key parameter to dcCategoriesview.asp, 2 dcproductslistClearance.asp, 3 PID parameter to ratings.asp, 4 dcProductsview.asp, 5 start, ...

CVE-2005-2220

Dragonfly Commerce allows remote attackers to change a product price by modifying the xDragonflyCartProductPrice hidden field to 1 dcCategorieslist.asp, 2 dcCategoriesview.asp, 3 dcproductslist.asp, and 4 dcproductslistClearance.asp. NOTE: the vendor has disputed this issue, saying that "Dragonfl...