CubeCart 6.0.10 - Multiple Vulnerabilities

Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16, 2016 Public Disclosure: March 30, 2016...

CubeCart SQL Injection Vulnerability (CNVD-2016-01942)

CubeCart is an open source PHP e-commerce software system. CubeCart suffers from a SQL injection vulnerability. Due to insufficient filtering of user-supplied data via the "char" HTTP GET parameter passed to the "/admin.php" PHP script input, a remotely authenticated attacker with privileged acce...

CubeCart 6.0.10 - Multiple Vulnerabilities

CubeCart 6.0.10 - Multiple Vulnerabilities Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16...

Multiple Vulnerabilities in CubeCart

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in popular open source shopping software CubeCart. The discovered vulnerabilities allow a remote attacker to compromise vulnerable website and its databases, and conduct sophisticated attacks against its users. 1 SQL...

CubeCart 6.0.7 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: CubeCart 6.0.7 Fixed in: 6.0.8 Fixed Version Link: https://www.cubecart.com/thank-you/CubeCart-6.0.8.zip Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/07/2015...

CubeCart 6.0.7 Code Execution

Security Advisory - Curesec Research Team 1. Introduction Affected Product: CubeCart 6.0.7 Fixed in: 6.0.8 Fixed Version Link: https://www.cubecart.com/thank-you/CubeCart-6.0.8.zip Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor:...

Devellion CubeCart Password Reset Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software. The classes/admin.class.php script in Devellion CubeCart fails to properly validate that a password reset request is occurring, allowing a remote attacker to change the administrator password by sending a specially...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

Cross site request forgery (csrf)

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

CubeCart is affected by a password-reset validation flaw in admin.class.php affecting 5.2.12–5.2.16 and 6.x (before 6.0.7). The issue allows a remote attacker to change the administrator password by sending a recovery request with a space character in the validate parameter and the administrator ...

CubeCart 6.0.6 Administrative Bypass

Application: CubeCart 6.0.6 5.2.12 Fixed: 07/09/2015 6.0.7 Credits: Fernando Câmara @overflowy Title: Admin account hijacking vulnerability Dork: inurl:"index.php?a=" Requirements: Default admin recovery functions enabled... Knowledge of the admin account email P.O.C Its possible for an attacker ...

CubeCart 3.0.x Arbitrary File Upload Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16796/info CubeCart is prone to an arbitrary file-upload vulnerability. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate...

CubeCart 3.x - Remote File Upload Vulnerability

No description provided by source...

cubecart 2.0.7 - Multiple Vulnerabilities

No description provided by source. Exploit Title: CubeCart 2.0.7 XSS && Remote SQL Injection = Multiple Vulnerabilities Date: June, 14th 2011 GMT +7 Author: Shamus Software Link: http://www.cubecart.com/ Version : CubeCart 2.0.7 Tested on: windows 7, ubuntu 11.04 CVE : -...

CubeCart 3.0.x /footer.inc.php la_pow_by Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied...

CubeCart 3.0.x /admin/nav.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied...

CubeCart 2.0.x Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/12658/info CubeCart is affected by multiple cross-site scripting vulnerabilities; an upgrade is available. These issues exist because the application fails to properly sanitize user-supplied input. As a result of these...

CubeCart 3.0.x view_order.php order_id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied...

CubeCart <= 3.0.4 - SQL Injection Vulnerability

No description provided by source. /////////////////? Dr.NeT @ Abdullah hacker team////////////// /// ///Title : CubeCart 3.0.4 = SQL injection Vulnerabilities /// ///Script : CubeCart 3.0.4 /// ///Language : Php /// ///Download : http://www.cubecart.com/ /// ///Date : 2010/12/23 /// ///Version :...