ECommerce-TIBSECART - Arbitrary File Upload

ECommerce-TIBSECART - Arbitrary File Upload Vulnerability:Profile Arbitrary Shell Upload Google Dork: ECommerce-TIBSECART Date:11.01.2017 Vendor Homepage: http://www.tibsolutions.com/tibs-ecart/ Script Name: ECommerce-TIBSECART Script Buy Now: http://www.tibsolutions.com/tibs-ecart/ Author: İhsan...

Convenient Mobile Commerce is the Key to Success this Holiday Season

With the Black Friday, Cyber Monday holiday weekend upon us, retailers in the U.S. and abroad are preparing for another peak period for customer acquisition and commerce revenues. In 2016, the U.S. eCommerce market is the second largest globally and...

CS-Cart 4.3.10 Unauthenticated XXE Injection

Software : CS-Cart From vendor site CS-Cart is an impressive platform for users to any level of eCommerce experience. With loads of features at a great price, CS-Cart is a great shopping cart solution that will quickly enable your online store to do business. XXE I : Twimgo addon...

CS-Cart 4.3.10 - XML External Entity Injection

Software : CS-Cart Ahmed sultan 0x4148 "; echo rawurlencodebase64encode$xml; ? change YOURHOST to your server address , use the output in the following POST request Action - HOST/cs-cart/index.php?dispatch=twigmo.post Data - action=addtocart&data=DATAOUTPUTHERE&format=xml a GET request will be se...

FireStorm Shopping Cart eCommerce Plugin 2.07.02 - Authenticated SQL Injection

$POST ‘pid’ is not escaped. Url is accessible for administrator user. Url with problem: http://localhost:1406/wp/wp-admin/admin.php?page=fssc-products=general=edit=0=0 http://target/wp-admin/admin.php?page=fssc-products&fp=general&f=edit&cid=0&pid=0+UNION+SELECT+name+FROM+wpterms+WHERE+termid=1...

Magento CMS Cross-Site Request Forgery Vulnerability

Magento CMS is an open source PHP e-commerce content management system CMS of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions . Magento CMS has a cross-site request forgery vulnerability that can be exploited by an...

Shopify: [ecommerce.shopify.com] Invalidated redirection

Hello, Endpoint : https://ecommerce.shopify.com/auth/shopify?shop=victimshop.myshopify.com&returnto=/////example.com Suppose, victim has not linked his shop with ecommerce.shopify.com portal then an attacker can redirect him on an external website after linking or rejecting. Steps to reproduce : ...

Web-Based Keylogger Used to Steal Credit Card Data from Popular Sites

Popular ecommerce sites have been infected with web-based keyloggers that are being used to steal credit card data as it’s entered into online checkout forms. More than 100 compromised sites have been identified, but the number could be in the thousands, researchers said. RiskIQ, in collaboration...

Peel Shopping 8.0.2 Object Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Peel Shopping 8.0.2 Fixed in: 8.0.3 Fixed Version Link: www.peel-shopping.com Vendor Website: www.peel-shopping.com Vulnerability Type: Object Injection Remote Exploitable: Yes Reported to vendor: 04/11/2016 Disclosed to...

Shopify: Deleted Post and Administrative Function Access in eCommerce Forum

Hi, I initially queried the following report as a comment in 165048, in which @juanbroullon confirmed the issue appeared valid and requested I open a new Shopify report. A selection of privileged information is provided upon appending /edit to a user profile URL on the eCommerce forum as an...

CubeCart 3.0.12 - Multiple Vulnerabilities

CubeCart 3.0.12 - Multiple Vulnerabilities CubeCart Multiple Vulnerabilities Vendor: Devellion Limited Product: CubeCart Version: = 3.0.12 Website: http://www.cubecart.com BID: 19782 CVE: CVE-2006-4525 OSVDB: 28279 28280 28281 SECUNIA: 21659 Description: CubeCart is a very popular web application...

CubeCart < 3.0.12 - Multiple Vulnerabilities

CubeCart Multiple Vulnerabilities Vendor: Devellion Limited Product: CubeCart Version: = 3.0.12 Website: http://www.cubecart.com BID: 19782 CVE: CVE-2006-4525 OSVDB: 28279 28280 28281 SECUNIA: 21659 Description: CubeCart is a very popular web application written in php that allows for an individu...

X-Cart 4.1.3 - Arbitrary Variable Overwrite

X-Cart 4.1.3 - Arbitrary Variable Overwrite X-Cart Arbitrary Variable Overwrite Vendor: Qualiteam Product: X-Cart Version: $value $$var = $value; As we can see every single post variable is dynamically evaluated. This is especially dangerous because register globals and magic quotes gpc settings ...

X-Cart < 4.1.3 - Arbitrary Variable Overwrite

X-Cart Arbitrary Variable Overwrite Vendor: Qualiteam Product: X-Cart Version: $value $$var = $value; As we can see every single post variable is dynamically evaluated. This is especially dangerous because register globals and magic quotes gpc settings do not affect an attackers ability to...

Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object Injection

The Ecwid Ecommerce Shopping Cart WordPress plugin was affected by an Unauthenticated PHP Object Injection security vulnerability...

Shopify: (BYPASS) Open Redirect after login at http://ecommerce.shopify.com

Hi, The users can be redirected to some other site which is in control of the attacker from http://ecommerce.shopify.com/accounts Let's say user is attacker asked victim to login from the here : https://ecommerce.shopify.com/accounts?returnto=%40evil.com/ When victim enters the password he is...

Ktools Photostore 4.7.5 - Multiple Vulnerabilities

Ktools Photostore 4.7.5 - Multiple Vulnerabilities -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Ktools Photostore = 4.7.5 Multiple Vulnerabilities Bug discovered by Yakir Wizman Date 01/07/2016 Affected versions prior to 4.7.5 Vendor Homepage - http://www.ktools.net...

modified eCommerce Shopsoftware 2.0.0.0 rev 9678 - Blind SQL Injection

No description provided by source...

Magento < 2.0.6 - Unauthenticated Remote Code Execution

参考来源：http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/ The vulnerability CVE-2016-4010 allows an attacker to execute PHP code at the vulnerable Magento server unauthenticated. This vulnerability actually consists of many small vulnerabilities Magento is an extremely...

modified eCommerce Shopsoftware 2.0.0.0 rev 9678 - Blind SQL Injection

modified eCommerce Shopsoftware 2.0.0.0 rev 9678 - Blind SQL Injection Title: Blind Injection modified eCommerce 2.0.0.0 rev 9678 Date: 16.04.2016 Category: webapps Vendor Homepage: http://www.modified-shop.org/download Software Link:...