EUVD-2006-5231

Malware in sbrugna...

CVE-2006-5246: Undefined Security Weakness

Eazy Cart allows remote attackers to change prices and other critical fields via unspecified vectors to easycart.php, probably including the price parameter. NOTE: some details are obtained from third party information...

CVE-2006-5247: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Eazy Cart allow remote attackers to inject arbitrary web script or HTML via easycart.php, possibly related to the 1 des and 2 qty parameters in an add action, and via other unspecified vectors. NOTE: some details are obtained from third party...

CVE-2006-5246

The CVE-2006-5246 issue concerns Eazy Cart where remote attackers can modify prices and other critical fields via unspecified vectors to easycart.php, likely abusing an input-validation flaw that permits altering the price parameter. The core weakness is insufficient validation/authorization on p...