CVE-2016-1154

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-1154

Cuore EC-CUBE Help plug-in (version 1.3.5 and earlier) contains an SQL injection (CWE-89) vulnerability. Remote attackers can execute arbitrary SQL via unspecified vectors, potentially exposing or altering database information. The affected component is the Help plug-in for EC-CUBE created by Cuo...

EC-CUBE plugin "Help plug-in" vulnerable to SQL injection

Overview EC-CUBE plugin "Help plug-in" provided by Cuore contains an SQL injection vulnerability CWE-89. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

JVN#31524757: EC-CUBE plugin "Help plug-in" vulnerable to SQL injection

EC-CUBE plugin "Help plug-in" provided by Cuore contains an SQL injection vulnerability CWE-89. Impact Information stored in the database may be obtained or altered by a remote attacker. Solution Update the plugin Update to the latest version according to the information provided by the developer...

CVE-2015-7784

SQL injection vulnerability in the BOKUBLOCK 1 BbAdminViewsControl213 plugin before 1.1 and 2 BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the BOKUBLOCK 1 BbAdminViewsControl213 plugin before 1.1 and 2 BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7784

SQL injection vulnerability in the BOKUBLOCK 1 BbAdminViewsControl213 plugin before 1.1 and 2 BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7784

CVE-2015-7784 affects EC-CUBE via the BbAdminViewsControl213 plugin (versions before 1.1) and BbAdminViewsControl plugin (versions before 2.1). The vulnerability is an SQL injection (CWE-89) that allows a logged-in, remote, authenticated attacker to execute arbitrary SQL commands via unspecified ...

EC-CUBE plugin BbAdminViewsControl vulnerable to SQL injection

Overview BbAdminViewsControl from BOKUBLOCK CO., LTD. is an EC-CUBE plugin. BbAdminViewsControl contains an SQL injection vulnerability CWE-89. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#55545372: EC-CUBE plugin BbAdminViewsControl vulnerable to SQL injection

BbAdminViewsControl from BOKUBLOCK CO., LTD. is an EC-CUBE plugin. BbAdminViewsControl contains an SQL injection vulnerability CWE-89. Impact A logged in attacker may execute SQL statements. According to the developer, this vulnerability affects availability of the server that EC-CUBE resides, bu...

LOCKON EC-CUBE Cross-Site Request Forgery Vulnerability (CNVD-2015-07298)

LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. A cross-site request forgery vulnerability exists in LOCKON EC-CUBE versions 2.11.0 through 2.13.3. It allows remote attackers to hijack arbitrary users to write PHP scripts and arbitrary user...

CVE-2015-5665

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function...

CVE-2015-5665

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function...

CVE-2015-5665

LOCKON EC-CUBE is affected by a CSRF vulnerability (CWE-352) affecting versions 2.11.0 through 2.13.3 (some sources list up to 2.13.4). The flaw enables an attacker to hijack the authentication of arbitrary users by inducing requests that write to PHP scripts, tied to the doValidToken function. I...

EC-CUBE vulnerable to cross-site request forgery

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability CWE-352. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#97278546: EC-CUBE vulnerable to cross-site request forgery

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page, arbitrary PHP code may be executed on the server. Solution Update or apply the patch Update to the...

CVE-2014-0807

data/class/pages/shopping/LCPageShoppingDeliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors...

CVE-2014-0808

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...

Authentication flaw

data/class/pages/shopping/LCPageShoppingDeliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors...