CVE-2018-18963

Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI...

CVE-2018-18963

Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI...

CVE-2018-18963

The CVE-2018-18963 affects Degrau Publicidade e Internet Plataforma de E-commerce; the issue is a SQL Injection in the Busca.aspx.cs file exploitable via the busca/ URI. The CNVD entry confirms a SQL injection vulnerability exists in that file. No explicit root-cause details or patch/mitigation a...

Site security & user friendliness: Top E-commerce qualities for 2018

By Carolina It seems security breaches have not just become common, but prevalent throughout society. Between allegations of hacking into voting systems, and then into the most influential social media platforms, digital security has never been more critical. Users and businesses alike must do al...

Magecart Cybergang Targets 0days in Third-Party Magento Extensions

Criminals behind the Magecart gang have shifted tactics, and are now targeting nearly two dozen unpatched vulnerabilities found in third-party plugins used in the Magento e-commerce platform. Previously, the Magecart cybergang had focused on the core of Magento, using attack strategies such as...

It will take more than web pages that load faster to boost holiday conversion

When designing websites to meet peak traffic demands, it is vital to look beyond basic metrics such as page load speed. Providing visual content optimized for both desktop and mobile devices, and combating security threats will help you drive traffic and improve conversion rates during the holida...

Magecart Group Targets Shopper Approved, Customers in Latest Attack

The notorious Magecart threat group has struck again, this time attacking Shopper Approved – a piece of third-party software that provides rating seals for online stores. The attack consequently put payment data from multiple online stores at risk. It’s only the most recent attack for Magecart, a...

A week in security (September 24 – 30)

Last week on Labs was a busy one. We discussed how SMS phishing attacks target the job market, issued a warning for TV Licensing phishes, commented on how Apple confused Safari users with recent changes to how OSX handles browser extensions, and elaborated on holes found in Mojave’s privacy...

How to protect your data from Magecart and other e-commerce attacks

In today's golden age of online shopping, consumers take to the Internet, punch in a few credit card details, and happily receive products at their doorstep, safe in the knowledge that their online vendor is well-known, vetted, and therefore their website has to be secure, right? Dut did you know...

Joomla! Component Dutch Auction Factory 2.0.2 - filter_order_Dir SQL Injection

Joomla! Component Dutch Auction Factory 2.0.2 - filterorderDir SQL Injection Exploit Title: Joomla! Component Dutch Auction Factory 2.0.2 - 'filterorderDir' SQL Injection Dork: N/A Exploit Author: Ihsan Sencan Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection

Exploit Title: Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/reverse-auction-factory/ Version: 4.3.8 Category: Webapps Test...

Joomla! Micro Deal Factory 2.4.0 SQL Injection

Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Dork: N/A Date: 2018-09-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/micro-deal-factory/ Version: 2.4....

Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection

Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Exploit Title: Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla! Component Micro Deal Factory 2.4.0 - id SQL Injection

Joomla! Component Micro Deal Factory 2.4.0 - id SQL Injection Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Dork: N/A Date: 2018-09-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection

Exploit Title: Joomla! Component Auction Factory 4.5.5 - 'filterorder' SQL Injection Exploit Author: Ihsan Sencan Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/auction-factory/ Version:...

Joomla Micro Deal Factory 2.4.0 Component - id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla Auction Factory 4.5.5 Component - filter_order SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Auction Factory 4.5.5 - 'filterorder' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection

Exploit Title: Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection Dork: N/A Date: 2018-09-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/micro-deal-factory/ Version: 2.4....

Thousands of Breached Websites Turn Up On MagBo Black Market

A newly-discovered underground marketplace has been peddling access to more than 3,000 breached websites, catering to hackers hungry for valuable data and the ability to launch a range of attacks on unsuspecting site visitors. Advertisements for the Russian-speaking marketplace called MagBo were...

MagentoCore Card Skimmer Found on Mass Numbers of E-Commerce Sites

UPDATED A whopping 7,339 and counting individual e-commerce sites have been infested with the MagentoCore.net payment-card skimmer in the last six months, making the malicious script one of the most successful credit-card threats out there. The infections are part of a single effort, all tied bac...