CVE-2008-3841

Technical details about CVE-2008-3841 are not publicly available in the provided connected documents. The initial description notes an XSS in Freeway eCommerce 1.4.1.171, but no vendor/versions/impact/fix are elaborated here. Monitor for updates.

CVE-2008-3841

Cross-site scripting XSS vulnerability in admin/searchlinks.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrary web script or HTML via the searchlink parameter...

phpcart-xss.txt

. . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com -d3hydr8 - sinner01 - baltazar - P47r1ck - C1c4Tr1Z - beenu -rsauron - letsgorun - K1u - DON - OutLawz - MAGE -JeTFyrE -r45c4l -Bond...

sunshop414-sql.txt

GulfTech Security Research August 18, 2008 Vendor : Turnkey Web Tools, Inc URL : http://www.turnkeywebtools.com Version : SunShop queryfirst"SELECT FROM ".$dbprefix."usersregistry WHERE id='".$POSTid."' AND userid='".$sess-gvar'userid'."'"; $data = filterdata$data; $out =...

DSECRG-08-036.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-036 Application: Freeway eCommerce Versions Affected: 1.4.1.171 Vendor URL: http://www.openfreeway.org/ Bugs: RFI, Multiple LFI, XSS Exploits: YES Reported: 27.06.2008 Second report: 04.07.2008 Vendor response: 06.07.2008 Solution: YES Dat...

SunShop Shopping Cart 4.1.4 - 'id' SQL Injection

GulfTech Security Research August 18, 2008 Vendor : Turnkey Web Tools, Inc URL : http://www.turnkeywebtools.com Version : SunShop queryfirst"SELECT FROM ".$dbprefix."usersregistry WHERE id='".$POSTid."' AND userid='".$sess-gvar'userid'."'"; $data = filterdata$data; $out =...

[DSECRG-08-036] Multiple Security Vulnerabilities in Freeway eCommerce 1.4.1.171

Digital Security Research Group DSecRG Advisory DSECRG-08-036 Application: Freeway eCommerce Versions Affected: 1.4.1.171 Vendor URL: http://www.openfreeway.org/ Bugs: RFI, Multiple LFI, XSS Exploits: YES Reported: 27.06.2008 Second report: 04.07.2008 Vendor response: 06.07.2008 Solution: YES Dat...

viart-sql.txt

GulfTech Security Research July 28, 2008 Vendor : ViArt, Ltd URL : http://www.viart.com/ Version : ViArt Shop = 3.5 Risk : SQL Injection Description: ViArt Shop is a full featured online ecommerce solution written in php. There is a high risk SQL Injection in ViArt that allows for an attacker to...

ViArt Shop 3.5 - category_id SQL Injection

ViArt Shop 3.5 - categoryid SQL Injection GulfTech Security Research July 28, 2008 Vendor : ViArt, Ltd URL : http://www.viart.com/ Version : ViArt Shop = 3.5 Risk : SQL Injection Description: ViArt Shop is a full featured online ecommerce solution written in php. There is a high risk SQL Injectio...

ViArt Shop <= 3.5 (category_id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================== ViArt Shop = 3.5 categoryid Remote SQL Injection Vulnerability ================================================================== GulfTech Security Research July 28, 2008...

ViArt Shop 3.5 - &#039;category_id&#039; SQL Injection

GulfTech Security Research July 28, 2008 Vendor : ViArt, Ltd URL : http://www.viart.com/ Version : ViArt Shop = 3.5 Risk : SQL Injection Description: ViArt Shop is a full featured online ecommerce solution written in php. There is a high risk SQL Injection in ViArt that allows for an attacker to...

Ecommerce Websites from b1st.com SQL Injection

Ecommerce Websites from b1st.com SQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com MAL : [email protected] DORK 1 : "Ecommerce Websites from b1st.com" DORK 2 : allinurl: EXPLOT WORKNG ON HTML STES LOOK Combo Deals UNDER PAGE YOU WLL SEE ALL USERS USERNAME AND PASSWORD...

b1st-sql.txt

Ecommerce Websites from b1st.com SQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com MAİL : [email protected] DORK 1 : "Ecommerce Websites from b1st.com" DORK 2 : allinurl: EXPLOİT WORKİNG ON HTML SİTES LOOK Combo Deals UNDER PAGE YOU WİLL SEE ALL USERS USERNAME AND...

Mambo Component Catalogshop 1.0b1 SQL Injection Vulnerability

No description provided by source. joomla SQL Injectioncomcatalogshop AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : allinurl: "comcatalogshop" EXPLOIT :...

joomlacatalog-sql.txt

joomla SQL Injectioncomcatalogshop AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : allinurl: "comcatalogshop" EXPLOIT : index.php?option=comcatalogshop&Itemid=S@BUN&func=detail&id=-1//union//select//null,null,concatpassword,3,4,5,6,7,8,9,10,11,12,concatusername//from//mosusers/ S@BUN...

Mambo Component com_catalogshop 1.0b1 - SQL Injection

Mambo Component comcatalogshop 1.0b1 - SQL Injection joomla SQL Injectioncomcatalogshop AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : allinurl: "comcatalogshop" EXPLOIT :...

Mambo Component &#039;com_catalogshop&#039; 1.0b1 - SQL Injection

joomla SQL Injectioncomcatalogshop AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : allinurl: "comcatalogshop" EXPLOIT : index.php?option=comcatalogshop&Itemid=S@BUN&func=detail&id=-1//union//select//null,null,concatpassword,3,4,5,6,7,8,9,10,11,12,concatusername//from//mosusers/ S@BUN...

CandyPress eCommerce suite 4.1.1.26 Multiple Remote Vulnerabilities

No description provided by source. WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available:...

candypress-multi.txt

WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available: Yes!, Update to 4.1.1.27...

[CandyPress] eCommerce suite &#40;SQL Injection + XSS + Path Disclosure&#41;

WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available: Yes!, Update to 4.1.1.27...