739 matches found
CVE-2007-2862
Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie...
CVE-2007-2862
CubeCart 3.0.16 contains multiple SQL injection vulnerabilities exploitable via an unspecified parameter to cart.inc.php and some files in an include directory. The root cause is missing sanitization of the $option variable, with possible cookie modification. Impact is remote arbitrary SQL execut...
CVE-2007-2862
Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie...
CVE-2007-2862: Undefined Security Weakness
Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie...
CubeCart Cart.Inc.PHP SQL注入漏洞
CubeCart是一款基于PHP的WEB应用程序。 CubeCart不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'Cart.Inc.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 CubeCart CubeCart 3.0.16 目前没有解决方案提供： http://www.cubecart.com...
Crlf injection
Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to 1 cart.php or 2 index.php...
CVE-2007-2550
Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to 1 cart.php or 2 index.php...
CVE-2007-2550
CVE-2007-2550 affects CubeCart 3.0.15 (Devellion) and involves multiple CRLF injection vulnerabilities in cookies named with a prefix of "ccSID", enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting against cart.php or index.php. The vulnerability is due ...
CVE-2007-2550: Undefined Security Weakness
Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to 1 cart.php or 2 index.php...
cubecart-crlf.txt
Note to BugTraq: Forgot to tell which files are vulnerable. Sorry! CubeCart v3.0.15 - CRLF Injection Vulnerability It is possible to set the cookie prefixed with ccSID to cause CRLF injection. Vulnerable files: cart.php, index.php HTTP Request: ------------- GET / HTTP/1.0 Accept: / User-Agent:...
Cubecart < 3.0.16 HTTP Response Splitting
Binary data 3984.prm...
UPDATED: CubeCart (v3.0.15) - CRLF Injection Vulnerability
Note to BugTraq: Forgot to tell which files are vulnerable. Sorry! CubeCart v3.0.15 - CRLF Injection Vulnerability It is possible to set the cookie prefixed with ccSID to cause CRLF injection. Vulnerable files: cart.php, index.php HTTP Request: ------------- GET / HTTP/1.0 Accept: / User-Agent:...
CubeCart <= 3.0.11 (oid) Remote Blind SQL Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' -------------------------------------------------------------------------------- CubeCart = 3.0.11 "oid" blind SQL injection / admin credentials disclosure exploit by rgod [email protected] site:...
CubeCart DB.Inc.PHP SQL注入漏洞
CubeCart是一款基于PHP的web应用程序。 CubeCart不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行sql注入攻击，获得敏感信息。 问题是由于'DB.Inc.PHP'脚本对用户提交的web参数缺少过滤，提交恶意sql查询作为参数数据，可更改原来的sql逻辑，获得敏感信息。 CubeCart CubeCart 3.0.14 http://www.cubecart.com ?php / Vendor : Devellion Limited 2006 Exploit: Blind SQL injection look below for more info Impac...
[Full-disclosure] CubeCart <=3.0.14 Bind Sql Injection POC.
Exploit Discoverd By Novalok & Kasper Of KasaNova Security Coded By A Friend ?php / Vendor : Devellion Limited 2006 Exploit: Blind SQL injection look below for more info Impact: of Discovered by: KasaNova Security --------------------------------------------------------------------------------...
CVE-2006-5108
Multiple cross-site scripting XSS vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the orderid parameter in 1 admin/printorder.php and 2 vieworder.php; the 3 siteurl and 4 lasearchhome parameters and 5 certain language parameters in...
CVE-2006-5107
Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via 1 the username parameter in admin/forgotpass.php, 2 the orderid parameter in vieworder.php, 3 the viewdoc parameter in viewdoc.php, and 4 the orderid parameter in...
CVE-2006-5109
Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for 1 linknavi.php or 2 spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, listdocs.php, popularprod.php, sale.php, checksum.php, and...
CubeCart.txt
Hello,, CubeCart Multiple input Validation vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Sql injection admin/forgotpass.php?submit=1&username=-1'or%201=1/ it will reset the password for the administrator --...
CVE-2006-5107
Affected product: Devellion CubeCart 2.0.x. The CVE describes multiple SQL injection vulnerabilities in CubeCart that allow remote attackers to execute arbitrary SQL commands. The specific vectors cited are: (1) user_name in admin/forgot_pass.php, (2) order_id in view_order.php, (3) view_doc in v...