CVE-2006-4267

Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 oid parameter in modules/gateway/Protx/confirmed.php and the 2 xinvoicenum parameter in modules/gateway/Authorize/confirmed.php...

CVE-2006-4268

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file, 2 x, and 3 y parameters in a admin/filemanager/preview.php; and the 4 email parameter in b admin/login.php...

CVE-2006-4268

CubeCart

CVE-2006-4267

CVE-2006-4267 affects CubeCart and earlier versions (up to 3.0.11) with multiple SQL injection flaws. Remote attackers can trigger SQL commands via the parameters (1) oid in modules/gateway/Protx/confirmed.php and (2) x_invoice_num in modules/gateway/Authorize/confirmed.php. The NVD entry lists a...

CVE-2006-4267

Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 oid parameter in modules/gateway/Protx/confirmed.php and the 2 xinvoicenum parameter in modules/gateway/Authorize/confirmed.php...

CubeCart <= 3.0.11 SQL injection & cross site scripting

-------------------------------------------------------------------------------- CubeCart = 3.0.11 SQL injection & cross site scripting software: site: http://www.cubecart.com/site/home/ description: "CubeCart is an eCommerce script written with PHP & MySQL. With CubeCart you can setup a powerful...

CubeCart <= 3.0.11 (oid) Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications =========================================================== CubeCart this works against MySQL =4.1 allowing subs -------------------------------------------------------------------------------- '; / short explaination: software site:...

CubeCart 3.0.11 - 'oid' Blind SQL Injection

!/usr/bin/php -q -d shortopentag=on this works against MySQL =4.1 allowing subs -------------------------------------------------------------------------------- '; / short explaination: software site: http://www.cubecart.com/site/home/ same kind of sql injection of...

CubeCart 3.0.x - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/19563/info CubeCart is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of these vulnerabilities could...

CubeCart 3.0.11 - oid Blind SQL Injection

CubeCart 3.0.11 - oid Blind SQL Injection !/usr/bin/php -q -d shortopentag=on this works against MySQL =4.1 allowing subs -------------------------------------------------------------------------------- '; / short explaination: software site: http://www.cubecart.com/site/home/ same kind of sql...

CubeCart < 3.0.12 Multiple Vulnerabilities (SQLi, XSS)

The version of CubeCart installed on the remote host fails to properly sanitize user-supplied input to several parameters and scripts before using it in database queries and to generate dynamic web content. An unauthenticated attacker may be able to exploit these issues to conduct SQL injection a...

CubeCart FCKeditor connector.php Arbitrary File Upload

The version of CubeCart installed on the remote host allows an unauthenticated user to upload files with arbitrary PHP code and then to execute them subject to the privileges of the web server user id. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CubeCart < 3.0.4 Multiple XSS Vulnerabilities

CubeCart is prone to multiple cross-site scripting XSS vulnerabilities due to its failure to properly sanitize user-supplied input of certain variables to the SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Multiple CubeCart XSS vulnerabilities

Description : The remote version of CubeCart contains several cross-site scripting vulnerabilities to due to its failure to properly sanitize user-supplied input of certain variables to the 'index.php' and 'cart.php' scripts. OpenVAS Vulnerability Test $Id: cubecartxss.nasl 5781 2017-03-30...

CVE-2006-0922

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...

Path traversal

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...

EUVD-2006-0926

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...

CVE-2006-0922

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...

CVE-2006-0922

CubeCart 3.0–3.6 contains an absolute path traversal/arbitrary file upload vulnerability in the admin FileUpload path (connector.php/upload.php) due to a missing auth.inc.php include. An unauthenticated attacker can upload arbitrary files via a modified CurrentFolder in a direct request to admin/...

NSAG-197-23.02.2006.txt

Advisory: NSAG-¹197-23.02.2006 Research: NSA Group Russian company on Audit of safety & Network security Site of Research: http://www.nsag.ru or http://www.nsag.org Product: CubeCart 3.0.0 – 3.0.6 Site of manufacturer: http://www.cubecart.com The status: 19/11/2005 - Publication is postponed...