Arbitrary file read vulnerability in S-CMS backend (CNVD-2020-57394)

S-CMS Government Station Building System, S-CMS School Station Building System, S-CMS News Portal System and S-CMS Enterprise Station Building System are developed by Zibo Shining Network Technology Co., Ltd. which is specialized in providing solutions for government station building.S-CMS Hospit...

CVE-2020-25093

Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel...

New Web-Based Credit Card Stealer Uses Telegram Messenger to Exfiltrate Data

Cybercriminal groups are constantly evolving to find new ways to pilfer financial information, and the latest trick in their arsenal is to leverage the messaging app Telegram to their benefit. In what's a new tactic adopted by Magecart groups, the encrypted messaging service is being used to send...

Magecart Credit-Card Skimmer Adds Telegram as C2 Channel

The e-commerce card-skimming landscape has a new wrinkle: Cybercriminals affiliated with the Magecart collective are using encrypted messaging service Telegram as a channel for sending stolen credit-card information back to its command-and-control C2 servers. That’s according to researchers who...

New web skimmer steals credit card data, sends to crooks via Telegram

The digital credit card skimming landscape keeps evolving, often borrowing techniques used by other malware authors in order to avoid detection. As defenders, we look for any kind of artifacts and malicious infrastructure that we might be able to identify to protect our users and alert affected...

Magecart’s Success Paves Way For Cybercriminal Credit Card 'Sniffer' Market

The Magecart threat group has dominated headlines for its use of malicious JavaScript code, which is injected into e-commerce websites to exfiltrate customer payment card data. But new research points to a growing industry on underground forums where so-called “sniffers” are being advertised, sol...

ShopXO open source e-commerce system has a file upload vulnerability

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO open source e-commerce system has a file upload vulnerability that can be exploited by an attacker to obtain server administrative privileges...

Ransom Demands Return: New DDoS Extortion Threats From Old Actors Targeting Finance and Retail

Update 08/24/2020 As mentioned below, the Akamai SIRT has been tracking attacks from the so-called Armada Collective and Fancy Bear actors, who are sending ransom letters to various industry verticals such as finance, travel, and e-commerce. In addition to the...

SQL injection vulnerability in go***.html of e-commerce logistics system page in Hualei Technology

Founded in 2013, Hualei Information Technology Co., Ltd. is an information technology service provider. A SQL injection vulnerability exists in the go.html page of the e-commerce logistics system of Hualei Technology, which can be exploited by attackers to obtain sensitive information from the...

Critical Magento Flaws Allow Code Execution

Critical flaws in Adobe’s Magento e-commerce platform – which is commonly targeted by attackers like the Magecart cybergang – could enable arbitrary code execution on affected systems. Magento is a popular, Adobe-owned open-source e-commerce platform that powers many online shops. Adobe on Tuesda...

SQL Injection Vulnerability in CMSWing of Xi'an Huashang Software Technology Co.

CMSWING is a ThinkJS-based e-commerce platform and CMS builder. Xi'an Huashang Software Technology Co., Ltd CMSWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Ltd. cross-border e-commerce integrated platform has SQL injection vulnerability

Ltd. was founded in 2013 as an information technology service provider. Ltd. cross-border e-commerce integrated platform suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

North Korean Hackers Spotted Using New Multi-Platform Malware Framework

Lazarus Group, the notorious hacking group with ties to the North Korean regime, has unleashed a new multi-platform malware framework with an aim to infiltrate corporate entities around the world, steal customer databases, and distribute ransomware. Capable of targeting Windows, Linux, and macOS...

SQL Injection Vulnerability in 5vshop E-commerce System of Shijiazhuang Zhenhong Network Technology Co.

5vshop belongs to Shijiazhuang Zhenghong Network Technology Co., Ltd, since 2004 has been committed to the enterprise Internet application of related services, engaged in enterprise, personal e-commerce website construction; e-commerce project planning, creativity, operation, to provide a...

Lazarus Group Surfaces with Advanced Malware Framework

The North Korea-linked APT known as Lazarus Group has debuted an advanced, multipurpose malware framework, called MATA, to target Windows, Linux and macOS operating systems. Kaspersky researchers uncovered a series of attacks utilizing MATA so-called because the malware authors themselves call...

5vshop e-commerce system has a logic flaw vulnerability

5vshop e-commerce system is shijiazhuang zhenghong network technology limited company a station building system. 5vshop e-commerce system has a logic flaw vulnerability, attackers can use this vulnerability to arbitrarily modify the payment amount, resulting in economic losses...

SQL injection vulnerability in website building system of Guangdong Qitai E-commerce Technology Company Limited (CNVD-2020-47343)

Ltd. is a B2B e-commerce website. There is a SQL injection vulnerability in the website system of Guangdong Kisitech E-commerce Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information from the database...

Keeper Threat Group Rakes in $7M from Hundreds of Compromised E-Commerce Sites

Since its launch three years ago, the Keeper threat group has compromised more than 570 e-commerce websites, from online liquor stores to Apple product resellers. And experts warn of future, increasingly sophisticated attacks against online merchants worldwide. The Keeper group, a faction of the...

Credit-Card Skimmer Has Unlikely Target: Microsoft ASP.NET Sites

Researchers have identified a credit-card skimming campaign that’s been active since mid-April that has a rather specific and unusual target: ASP.NET-based websites running on Microsoft Internet Information Services IIS servers. New research from Malwarebytes Labs recently uncovered the campaign,...

S-CMS e-commerce system aj***.php suffers from SQL injection vulnerability

S-CMS e-commerce system is developed by php+mysql, the website is easy and fast to install. Search engine is more easy to crawl and index , provide more features to improve user-friendly experience . S-CMS e-commerce system aj.php SQL injection vulnerability, attackers can use the vulnerability t...