CVE-2006-6041

This CVE (CVE-2006-6041) describes multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2 and earlier versions up to 3.0.4. The flaw allows an attacker to trigger remote PHP code execution by supplying a URL in the g_include parameter for several...

CVE-2006-6034

Multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition allow remote attackers to execute arbitrary SQL commands via the 1 keyword or 2 cid parameter in a catalogue.asp, or the 3 pid parameter in b viewDetail.asp...

CVE-2006-6034

CVE-2006-6034 involves multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition. The affected functionality allows remote attackers to inject SQL via parameters in catalogue.asp (keyword, cid) and in viewDetail.asp (pid). The provided sources describe arbitrary SQL ex...

CVE-2006-6034

Multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition allow remote attackers to execute arbitrary SQL commands via the 1 keyword or 2 cid parameter in a catalogue.asp, or the 3 pid parameter in b viewDetail.asp...

WORK System E-Commerce g_include参数远程文件包含漏洞

WORK System E-Commerce是一款动态内容和站点管理系统。 WORK System E-Commerce在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意指令。 WORK System E-Commerce的index.php和module/forum/forum.php脚本没有正确验证ginclude参数的输入，允许攻击者通过包含本地或外部资源文件执行任意PHP代码。漏洞相关的代码如下： include $ginclude."file.inc"; Laurent Van den Reysen WORK system...

CVE-2006-5959

SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter...

CVE-2006-5959

The CVE-2006-5959 vulnerability is an SQL injection in browse.asp of A+ Store E-Commerce, exploitable via the ParentID parameter to allow remote execution of arbitrary SQL commands. Vulnerable component: browse.asp; vulnerability type: SQL injection; impact per sources: unauthorized data access/m...

CVE-2006-5959

SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter...

CVE-2006-5960

CVE-2006-5960 concerns XSS vulnerabilities in A+ Store E-Commerce, specifically in account_login.asp. The issue allows remote attackers to inject arbitrary script/HTML via the username (txtUserName) and password (txtPassword) parameters. The vulnerability affects the login page’s input handling a...

ecomkit1.txt

vendor site:http://www.sitesoutlet.com/ product:E-commerce Kit 1 PayPal Edition bug:injection sql risk:medium injection sql : http://site.com/PATH/catalogue.asp?keyword='sql http://site.com/PATH/catalogue.asp?cid='sql http://site.com/PATH//viewDetail.asp?pid='sql laurent gaffié & benjamin mossé...

ASPintranet SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/ecommercekit.txt ----------------------------------------------------------- Software: UStore | E-Commerce Kit 2 Vendor: http://www.sitesoutlet.com...

CVE-2006-5936

SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter...

E-commerce Kit 1 PayPal Edition [ injection sql ]

vendor site:http://www.sitesoutlet.com/ product:E-commerce Kit 1 PayPal Edition bug:injection sql risk:medium injection sql : http://site.com/PATH/catalogue.asp?keyword='sql http://site.com/PATH/catalogue.asp?cid='sql http://site.com/PATH//viewDetail.asp?pid='sql laurent gaffie & benjamin mosse...

astoreecom.txt

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username = '"alertdocument.cookie'"alertdocument.cookie passwd =...

eShopping SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/ecommercestore.txt ----------------------------------------------------------- Software: E Commerce Store Shop Builder Method : SQL Injection PoC:...

CVE-2006-5936

CVE-2006-5936 describes an SQL injection in dept.asp of the SiteXpress E-Commerce System, exploitable via the id parameter to allow remote execution of arbitrary SQL commands. Affected component: dept.asp in SiteXpress E-Commerce System. Root cause: improper handling of the id parameter leading t...

Ustore SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian Original Advisory : http://aria-security.net/advisory/UStore.txt ----------------------------------------------------------- Software: UStore | E-Commerce in 15-Minutes Method : Sql Injection PoC:...

CVE-2006-5936

SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter...

sitexpress.txt

Aria-Security Team Advisory Original Advisory : http://aria-security.net/advisory/SiteXpress.txt ----------------------------------------------------------- Software: SiteXpress E-Commerce System Method : SQL Injection PoC: http://target/path/ http://target/path/dept.asp?id=SQL Contact:...

ecommercestore.txt

Aria-Security Team Advisory Original Advisory : http://aria-security.net/advisory/ecommercestore.txt ----------------------------------------------------------- Software: E Commerce Store Shop Builder Method : SQL Injection PoC:...