CubeCart 3.0.20 Multiple Vulnerabilities

CubeCart versions 3.0.20 and below suffer from a remote shell upload, cross site scripting and remote SQL injection vulnerabilities. 1. OVERVIEW CubeCart 3.0.20 and lower versions are vulnerable to Arbitrary File Upload. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart softwa...

CubeCart 4.4.6 Cross Site Request Forgery

OVERVIEW CubeCart 4.4.6 and lower versions are vulnerable to Cross Site Request Forgery CSRF. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a...

CubeCart 4.4.6 Local File Inclusion

OVERVIEW CubeCart 4.4.6 and lower versions are vulnerable to Local File Inclusion. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a powerful online...

CubeCart 4.4.6 Open URL Redirection

OVERVIEW CubeCart 4.4.6 and lower versions are vulnerable to Open URL Redirection. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a powerful online...

CubeCart 4.4.6 SQL Injection

OVERVIEW The CubeCart 4.4.6 and lower versions are vulnerable to SQL Injection. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a powerful online...

CubeCart 3.0.20 Shell Upload

OVERVIEW CubeCart 3.0.20 and lower versions are vulnerable to Arbitrary File Upload. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a powerful...

CubeCart 3.0.20 SQL Injection

OVERVIEW The CubeCart 3.0.20 and lower versions are vulnerable to SQL Injection. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a powerful online...

Paypal Core Bug Bounty #3 - Persistent Web Vulnerability

Document Title: =============== Paypal Core Bug Bounty 3 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=635 Release Date: ============= 2012-12-12 Vulnerability Laboratory ID VL-ID: ==================================== 635...

Axis Commerce 0.8.7.2 Cross Site Scripting Vulnerability

Axis Commerce version 0.8.7.2 suffers from multiple stored cross site scripting vulnerabilities. Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities alert'XSS';", "base":"TESTSTRING",...

PayPal Open Redirection

Title: ====== Paypal BugBounty 11 - Redirection Web Vulnerability Date: ===== 2012-11-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=648 VL-ID: ===== 648 Common Vulnerability Scoring System: ==================================== 2 Introduction: ============= PayPal i...

Citadel Trojan Updates with Dynamic Config Mechanism that Streamlines Fraud Activity

The elusive authors of the Citadel Trojan have released a new version of their banking botnet malware and service. The latest version, the sixth since it debuted in January and dubbed Rain, includes a dynamic configuration mechanism that allows botmasters to inject malicious content to compromise...

Unirgy uStoreLocator Magento Extension SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: SQL Injection product: Unirgy uStoreLocator - Magento extension vulnerable version: =2.0.1 impact: High homepage: http://www.unirgy.com/ found: 2012-06-18 by: K...

WordPress Shopp v1.0.17 - eCommerce Plugin <= XSS/LFI Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

PayPal Cross Site Scripting

Title: ====== Paypal BugBounty 9 - Persistent Web Vulnerabilities Date: ===== 2012-10-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=646 VL-ID: ===== 646 Common Vulnerability Scoring System: ==================================== 7.2 Introduction: ============= PayPal...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

Dream Ecommerce SQL Injection

Exploit Title: dreamecommerce sql injection Vulnerability Google Dork: inurl:board/sview.php?boardname= Date: 09/28/2012 Author: Crim3R download Link Or Vendor Home: http://dreamecommerce.net/ Tested on: all ================================== boardname parametr is injectable D3M0 :...

CVE-2011-5198

SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information...

CVE-2011-5198

CVE-2011-5198 is a confirmed SQL injection in the Neturf eCommerce Shopping Cart, targeting the search.php endpoint. The vulnerability allows remote attackers to append arbitrary SQL via the SearchFor parameter (no authentication required, network access). CVSS v2 metrics indicate a base score of...

CVE-2011-5198

SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information...