Comdev eCommerce 3.0 - 'config.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/14478/info Comdev eCommerce is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary server-side script code on an...

[HSC Security Group] SQL Injection in Product Cart 2.6

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: SQL Injection in Product Cart 2.6 Risk: Medium to High An SQL injection affects Product Cart 2.6. Database Manipulation is possible. viewPrd.asp?idcategory=' Vendor: http://www.earlyimpact.com/ "Our...

CVE-2005-2138

CVE-2005-2138 describes a Cross-site Scripting (XSS) vulnerability in the Comdev eCommerce 3.0 and 3.1 product line, specifically in index.php. The flaw allows remote attackers to inject arbitrary web script or HTML by injecting Javascript into the onMouseOver event of an anchor tag in a review m...

CVE-2005-2138

Cross-site scripting XSS vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message...

CVE-2005-2138

Cross-site scripting XSS vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message...

CVE-2005-2138: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message...

[SA15865] Comdev eCommerce Review Script Insertion Vulnerability

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2005-1967

Multiple SQL injection vulnerabilities in ProductCart Ecommerce before 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 idcategory parameter to viewPrd.asp, 2 lid parameter to editCategories.asp, 3 icd parameter to modCustomCardPaymentOpt.asp, or 4 idccr parameter to...

CVE-2005-1967

Affected: ProductCart Ecommerce before 2.7. Vulnerable inputs: idcategory (viewPrd.asp), lid (editCategories.asp), icd (modCustomCardPaymentOpt.asp), idccr (OptionFieldsEdit.asp). Root cause: unsanitized user input enabling SQL injection. Impact: remote attacker could execute arbitrary SQL, with ...

CVE-2005-1968

Cross-site scripting XSS vulnerability in ProductCart Ecommerce before 2.7 allows remote attackers to inject arbitrary web script or HTML via the error parameter to techErr.asp...

CVE-2005-1967

Multiple SQL injection vulnerabilities in ProductCart Ecommerce before 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 idcategory parameter to viewPrd.asp, 2 lid parameter to editCategories.asp, 3 icd parameter to modCustomCardPaymentOpt.asp, or 4 idccr parameter to...

CVE-2005-1968

CVE-2005-1968 affects ProductCart Ecommerce prior to 2.7. The vulnerability is a cross-site scripting (XSS) flaw where an attacker can inject arbitrary script/HTML via the error parameter to techErr.asp. The grouped connected records corroborate the same description across multiple sources and li...

CVE-2005-1968: Undefined Security Weakness

Cross-site scripting XSS vulnerability in ProductCart Ecommerce before 2.7 allows remote attackers to inject arbitrary web script or HTML via the error parameter to techErr.asp...

CVE-2005-1967: Undefined Security Weakness

Multiple SQL injection vulnerabilities in ProductCart Ecommerce before 2.7 allow remote attackers to execute arbitrary SQL commands via the 1 idcategory parameter to viewPrd.asp, 2 lid parameter to editCategories.asp, 3 icd parameter to modCustomCardPaymentOpt.asp, or 4 idccr parameter to...

osCommere HTTP Response Splitting

GulfTech Security Research June 10th, 2005 Vendor : osCommerce URL : http://www.oscommerce.com/ Version : osCommerce 2.2 Milestone 2 && Earlier Risk : HTTP Response Splitting Description: osCommerce is a very popular eCommerce application that allows for individuals to host their own online shop...

CVE-2005-1968

Cross-site scripting XSS vulnerability in ProductCart Ecommerce before 2.7 allows remote attackers to inject arbitrary web script or HTML via the error parameter to techErr.asp...

ecomSQL.txt

IHS Iran Hackers Sabotage Public advisory by : c0d3r "Kaveh Razavi" [email protected] ---------------------------------------------------------- advisory url : http://www.ihssecurity.com/cms/modules/mydownloads/visit.php?lid=8 application : Ecommerce-Carts EcommProV.3 and prior vender :...

CVE-2005-1221

The CVE-2005-1221 entry concerns Ecommerce-Carts EcommPro 3.0 with a SQL injection in login.asp via the password field. Concrete details from connected documents show the vulnerability is caused by improper input handling in the password parameter, enabling remote attackers to execute arbitrary S...

CVE-2005-1221: Undefined Security Weakness

SQL injection vulnerability in login.asp for Ecommerce-Carts EcommPro 3.0 allows remote attackers to execute arbitrary SQL commands via the password field...

Ecommerce-Carts SQL injection vulnerability ( IHSTeam )

IHS Iran Hackers Sabotage Public advisory by : c0d3r "Kaveh Razavi" [email protected] ---------------------------------------------------------- advisory url : http://www.ihssecurity.com/cms/modules/mydownloads/visit.php?lid=8 application : Ecommerce-Carts EcommProV.3 and prior vender :...