622 matches found
CubeCart <= 2.0.6 Multiple SQL Injections
The installed version of CubeCart on the remote host suffers from multiple SQL injection vulnerabilities due to its failure to sanitize user input via the 'PHPSESSID' parameter of the 'index.php' script, the 'product' parameter of the 'tellafriend.php' script, the 'add' parameter of the...
Brooky CubeCart < 2.0.7 Multiple Script SQL Injection
Binary data 2801.prm...
RE: [NOBYTES.COM: #6] CubeCart 2.0.6 - Information Disclosure
Hello, http://www.victimsite.com/index.php?&language=f00bar.php Warning: Failed opening '/var/www/html/admin/lang/f00bar.php' for inclusion includepath='.:/usr/share/pear' in /var/www/html/admin/settings.inc.php on line 147 This is path disclosure but it can also be used for malicious file includ...
CubeCart 2.0.x - 'index.php' Multiple Full Path Disclosures
source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. These issues affect the 'index.php',...
CubeCart 2.0.x - 'tellafriend.php?product' Full Path Disclosure
source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. These issues affect the 'index.php',...
CubeCart 2.0.x - view_cart.php?add Full Path Disclosure
CubeCart 2.0.x - viewcart.php?add Full Path Disclosure source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL...
CubeCart 2.0.x - index.php Multiple Full Path Disclosures
CubeCart 2.0.x - index.php Multiple Full Path Disclosures source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL...
CubeCart 2.0.x - view_product.php?product Full Path Disclosure
CubeCart 2.0.x - viewproduct.php?product Full Path Disclosure source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in...
CubeCart 2.0.x - tellafriend.php?product Full Path Disclosure
CubeCart 2.0.x - tellafriend.php?product Full Path Disclosure source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in...
[NOBYTES.COM: #6] CubeCart 2.0.6 - Information Disclosure
Hello All, I have discovered a number of remote vulnerabilities in: CubeCart 2.0.6. Authors Site: http://www.cubecart.com CubeCart is described by its authors as: 'What is CubeCart? CubeCart is an eCommerce script written with PHP & MySQL. With CubeCart you can setup a powerful online store as lo...
CubeCart 2.0.x - 'view_product.php?product' Full Path Disclosure
source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. These issues affect the 'index.php',...
CubeCart 2.0.x - 'view_cart.php?add' Full Path Disclosure
source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. These issues affect the 'index.php',...
CubeCart < 2.0.6 settings.inc.php Multiple Script XSS
According to its banner, the version of CubeCart installed on the remote host suffers from multiple cross-site scripting and path disclosure vulnerabilities due to a failure to sanitize user input in 'admin/settings.inc.php', which is used by various scripts. %NASLMINLEVEL 70300 C Tenable Network...
CVE-2005-0607
CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to 1 information.php, 2 language.php, 3 listdocs.php, 4 popularprod.php, 5 sale.php, 6 subfooter.inc.php, 7 subheader.inc.php, 8 catnavi.php, or 9 checksum.php, which...
CVE-2005-0607
CubeCart 2.0.0–2.0.5 allows remote attackers to determine the server’s full path by calling certain PHP files without parameters (information.php, language.php, list_docs.php, popular_prod.php, sale.php, subfooter.inc.php, subheader.inc.php, cat_navi.php, check_sum.php). The flaw exposes the serv...
CVE-2005-0606
CubeCart 2.0.0–2.0.5 contains a Cross‑Site Scripting (XSS) vulnerability in settings.inc.php. The issue allows remote attackers to inject arbitrary HTML/web script via any of the following parameters used across multiple PHP files: cat_id, PHPSESSID, view_doc, product, session, catname, search, o...
CVE-2005-0606
Cross-site scripting XSS vulnerability in settings.inc.php for CubeCart 2.0.0 through 2.0.5, as used in multiple PHP files, allows remote attackers to inject arbitrary HTML or web script via the 1 catid, 2 PHPSESSID, 3 viewdoc, 4 product, 5 session, 6 catname, 7 search, or 8 page parameters...
[SA14416] CubeCart Cross-Site Scripting Vulnerabilities
---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...
CubeCart < 2.0.5 Multiple Vulnerabilities
The version of CubeCart on the remote host is vulnerable to a local file include issue, along with related cross-site scripting and path disclosure issues, due to a failure to sanitize user-supplied data. Successful exploitation of this issue may allow an attacker to execute arbitrary code on the...