739 matches found
[SA21659] CubeCart Multiple Vulnerabilities
TITLE: CubeCart Multiple Vulnerabilities SECUNIA ADVISORY ID: SA21659 VERIFY ADVISORY: http://secunia.com/advisories/21659/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data, Exposure of sensitive information WHERE: From remote SOFTWARE: CubeCart 3.x...
CubeCart < 3.0.13 Multiple Vulnerabilities
Binary data 3736.prm...
cubecart_3011_adv.txt
-------------------------------------------------------------------------------- CubeCart alertdocument.cookie http://target/pathtocubecart/admin/filemanager/preview.php?file=1&x="alertdocument.cookie http://target/pathtocubecart/admin/filemanager/preview.php?file=1&y="alertdocument.cookie...
CVE-2006-4268
Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file, 2 x, and 3 y parameters in a admin/filemanager/preview.php; and the 4 email parameter in b admin/login.php...
CVE-2006-4267
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 oid parameter in modules/gateway/Protx/confirmed.php and the 2 xinvoicenum parameter in modules/gateway/Authorize/confirmed.php...
CVE-2006-4268
Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file, 2 x, and 3 y parameters in a admin/filemanager/preview.php; and the 4 email parameter in b admin/login.php...
CVE-2006-4268
CubeCart
CVE-2006-4267
CVE-2006-4267 affects CubeCart and earlier versions (up to 3.0.11) with multiple SQL injection flaws. Remote attackers can trigger SQL commands via the parameters (1) oid in modules/gateway/Protx/confirmed.php and (2) x_invoice_num in modules/gateway/Authorize/confirmed.php. The NVD entry lists a...
CVE-2006-4267
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 oid parameter in modules/gateway/Protx/confirmed.php and the 2 xinvoicenum parameter in modules/gateway/Authorize/confirmed.php...
CVE-2006-4268: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file, 2 x, and 3 y parameters in a admin/filemanager/preview.php; and the 4 email parameter in b admin/login.php...
CVE-2006-4267: Undefined Security Weakness
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 oid parameter in modules/gateway/Protx/confirmed.php and the 2 xinvoicenum parameter in modules/gateway/Authorize/confirmed.php...
CubeCart <= 3.0.11 SQL injection & cross site scripting
-------------------------------------------------------------------------------- CubeCart = 3.0.11 SQL injection & cross site scripting software: site: http://www.cubecart.com/site/home/ description: "CubeCart is an eCommerce script written with PHP & MySQL. With CubeCart you can setup a powerful...
CubeCart <= 3.0.11 (oid) Remote Blind SQL Injection Exploit
Exploit for unknown platform in category web applications =========================================================== CubeCart this works against MySQL =4.1 allowing subs -------------------------------------------------------------------------------- '; / short explaination: software site:...
CubeCart 3.0.11 - 'oid' Blind SQL Injection
!/usr/bin/php -q -d shortopentag=on this works against MySQL =4.1 allowing subs -------------------------------------------------------------------------------- '; / short explaination: software site: http://www.cubecart.com/site/home/ same kind of sql injection of...
CubeCart 3.0.x - Multiple Input Validation Vulnerabilities
source: https://www.securityfocus.com/bid/19563/info CubeCart is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of these vulnerabilities could...
CubeCart 3.0.11 - oid Blind SQL Injection
CubeCart 3.0.11 - oid Blind SQL Injection !/usr/bin/php -q -d shortopentag=on this works against MySQL =4.1 allowing subs -------------------------------------------------------------------------------- '; / short explaination: software site: http://www.cubecart.com/site/home/ same kind of sql...
CubeCart < 3.0.12 Multiple Vulnerabilities (SQLi, XSS)
The version of CubeCart installed on the remote host fails to properly sanitize user-supplied input to several parameters and scripts before using it in database queries and to generate dynamic web content. An unauthenticated attacker may be able to exploit these issues to conduct SQL injection a...
CubeCart FCKeditor connector.php Arbitrary File Upload
The version of CubeCart installed on the remote host allows an unauthenticated user to upload files with arbitrary PHP code and then to execute them subject to the privileges of the web server user id. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Multiple CubeCart XSS vulnerabilities
Description : The remote version of CubeCart contains several cross-site scripting vulnerabilities to due to its failure to properly sanitize user-supplied input of certain variables to the 'index.php' and 'cart.php' scripts. OpenVAS Vulnerability Test $Id: cubecartxss.nasl 5781 2017-03-30...
CubeCart < 3.0.4 Multiple XSS Vulnerabilities
CubeCart is prone to multiple cross-site scripting XSS vulnerabilities due to its failure to properly sanitize user-supplied input of certain variables to the SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...