CPCommerce Manufacturer.PHP SQL注入漏洞

CPCommerce是一款基于PHP的WEB应用程序。 CPCommerce不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Manufacturer.PHP'脚本对用户提交的'idmanufacturer'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 cpCommerce cpCommerce 1.1 目前没有解决方案提供： http://cpcommerce.cpradio.org/...

CVE-2007-2968: Undefined Security Weakness

Cross-site scripting XSS vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter Full Name field...

CVE-2007-2959

SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the idmanufacturer parameter...

Sql injection

SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the idmanufacturer parameter...

CVE-2007-2959

CVE-2007-2959 affects cpCommerce before 1.1.0. The vulnerability is an SQL injection in manufacturer.php exploitable via the id_manufacturer parameter, allowing remote attackers to execute arbitrary SQL. The NVD entry lists a high impact (base score 7.5) with network access and no authentication ...

CVE-2007-2959

SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the idmanufacturer parameter...

CVE-2007-2959: Undefined Security Weakness

SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the idmanufacturer parameter...

CVE-2007-2890

SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idcategory parameter...

Sql injection

SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idcategory parameter...

CVE-2007-2890

SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idcategory parameter...

CVE-2007-2890

cpCommerce vulnerable to SQL injection in category.php (versions 1.1.0 and earlier). The flaw allows remote attackers to inject SQL via the id_category parameter, enabling arbitrary SQL execution. Documents do not specify the root cause details, affected software versions beyond 1.1.0, exploitabl...

cpcommerce-sql.txt

126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15...

CVE-2007-2890: Undefined Security Weakness

SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idcategory parameter...

cpcommerce < v1.1.0 [sql injection]

vendor site:http://cpcommerce.cpradio.org/ product:cpcommerce v1.1.0 bug: sql injection risk : high note:works regardless of php.ini settings . http://127.0.0.1/cpcommerce/manufacturer.php?idmanufacturer=-9//union//select//pass,LOADFILE0x2F6574632F706173737764,0//from//cpAccounts/ //result:...

CPCommerce 1.1 - manufacturer.php SQL Injection

CPCommerce 1.1 - manufacturer.php SQL Injection source: https://www.securityfocus.com/bid/24223/info cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

CPCommerce 1.1 - 'manufacturer.php' SQL Injection

source: https://www.securityfocus.com/bid/24223/info cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

Vulnerability - cpCommerce - XSS

cpcommerce is a FOSS php-based e-commerce shopping cart web application. Exploit: Javascript placed inside a user's "Full Name:" field will not be stripped - it will be added to the database 'as-is' as long as it has no quotations in the string. When the admin goes to the clients view page, the...

cpCommerce <= 1.1.0 (category.php id_category) SQL Injection Exploit

Exploit for unknown platform in category web applications ==================================================================== cpCommerce 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$str...

CVE-2003-1500

PHP remote file inclusion vulnerability in functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter...

PT-2003-2445 · Cpcommerce · Cpcommerce

Name of the Vulnerable Software and Affected Versions: cpCommerce version 0.5f Description: The issue allows remote attackers to execute arbitrary code via the prefix parameter in the functions.php file. This is a result of a remote file inclusion vulnerability. Recommendations: For cpCommerce...