622 matches found
CubeCart204.txt
Hello All, I have discovered a number of remote vulnerabilities in: CubeCart 2.0.4. Authors Site: http://www.cubecart.com CubeCart is described by its authors as: 'What is CubeCart? CubeCart is an eCommerce script written with PHP & MySQL. With CubeCart you can setup a powerful online store as lo...
CVE-2004-1579
index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid catid parameter, which reveals the full path in a PHP error message...
CVE-2004-1580
SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter...
CVE-2004-1579
CVE-2004-1579 affects CubeCart 2.0.1. The issue is an information disclosure: sending an HTTP request with an invalid cat_id parameter causes a PHP error message that reveals the full path, exposing partial confidentiality loss. The NVD entry reports a base score of 5.0 (MEDIUM) with network atta...
CVE-2004-1580
CubeCart 2.0.1 is affected: index.php uses the cat_id parameter in SQL queries, enabling remote SQL injection to potentially modify or disclose data. Root cause: unsafely constructed SQL from user input in cat_id. Impact aligns with CVSS: HIGH (partial confidentiality, integrity, and availability...
CVE-2005-0443
index.php in CubeCart 2.0.4 allows remote attackers to 1 obtain the full path for the web server or 2 conduct cross-site scripting XSS attacks via an invalid language parameter, which echoes the parameter in a PHP error message...
CVE-2005-0442
Directory traversal vulnerability in index.php for CubeCart 2.0.4 allows remote attackers to read arbitrary files via the language parameter...
CVE-2005-0442
CVE-2005-0442 maps to a directory traversal in CubeCart 2.0.4’s index.php via the language parameter. OpenVAS/Nessus entries corroborate broader CubeCart
CVE-2005-0443
CubeCart 2.0.4 is affected by a remote XSS and path disclosure vulnerability in index.php triggered by an invalid language parameter that is echoed in a PHP error message. The OpenVAS entry and NVD/CVE records corroborate a language-based XSS/vector that can reveal the install path; CVSS v2 base ...
Brooky CubeCart Multiple Vulnerabilities
Binary data 2617.prm...
Brooky CubeCart 2.0.12.0.4 - index.php?language Cross-Site Scripting
Brooky CubeCart 2.0.12.0.4 - index.php?language Cross-Site Scripting source: https://www.securityfocus.com/bid/12549/info Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to...
Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Traversal Arbitrary File Access
source: https://www.securityfocus.com/bid/12549/info Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks. The...
Brooky CubeCart 2.0.12.0.4 - index.php?language Traversal Arbitrary File Access
Brooky CubeCart 2.0.12.0.4 - index.php?language Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/12549/info Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attacke...
Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Cross-Site Scripting
source: https://www.securityfocus.com/bid/12549/info Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks. The...
CVE-2004-1579
index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid catid parameter, which reveals the full path in a PHP error message...
CVE-2004-1580
SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter...
Brooky CubeCart < 2.0.2 index.php cat_id Parameter SQL Injection
Binary data 2431.prm...
CubeCart index.php cat_id Parameter SQL Injection
There is a SQL injection issue in the remote version of CubeCart that could allow an attacker to execute arbitrary SQL statements on the remote host and to potentially overwrite arbitrary files on the remote system, by sending a malformed value to the 'catid' argument of the file 'index.php'...
[SA12764] CubeCart "cat_id" SQL Injection Vulnerability
TITLE: CubeCart "catid" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA12764 VERIFY ADVISORY: http://secunia.com/advisories/12764/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: CubeCart 2.x http://secunia.com/product/4021/ DESCRIPTION: Pedro Sanches h...
Full path disclosure and sql injection on CubeCart 2.0.1
-------------------------------------------------------- Full path disclosure and sql injection on CubeCart 2.0.1 -------------------------------------------------------- 1Introduction 2The Problem 3The Solution 4Timeline 5Feddback 1Introduction "CubeCart is an eCommerce script written with PHP &...