QualiteamXCart远程命令执行漏洞

X-Cart是一款基于PHP的电子商务程序。X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart3.4.3 厂商补丁：Qualiteam --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.x-cart.com/...

CVE-2006-4904

CVE-2006-4904 affects Qualiteam X-Cart 4.1.3 and earlier. A vulnerability in the cmpi.php script allows dynamic variable evaluation, permitting an attacker to overwrite arbitrary configuration variables and execute arbitrary PHP code (demonstrated via PHP remote file inclusion using the xcart_dir...

[SA22005] Qualiteam X-Cart cmpi.php Variable Overwriting Vulnerability

TITLE: Qualiteam X-Cart cmpi.php Variable Overwriting Vulnerability SECUNIA ADVISORY ID: SA22005 VERIFY ADVISORY: http://secunia.com/advisories/22005/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Qualiteam X-Cart Pro 4.x http://secunia.com/product/11995/ Qualiteam...

CVE-2005-1823

Multiple cross-site scripting XSS vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 cat or 2 printable parameter to home.php, 3 productid or 4 mode parameter to product.php, 5 id parameter to errormessage.php, 6 section parameter to...

CVE-2005-1822

Multiple SQL injection vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to execute arbitrary SQL commands via the 1 cat or 2 printable parameter to home.php, 3 productid or 4 mode parameter to product.php, 5 id parameter to errormessage.php, 6 section parameter to help.php, 7 mode...

CVE-2005-1823

Multiple cross-site scripting XSS vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 cat or 2 printable parameter to home.php, 3 productid or 4 mode parameter to product.php, 5 id parameter to errormessage.php, 6 section parameter to...

CVE-2005-1822

Multiple SQL injection vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to execute arbitrary SQL commands via the 1 cat or 2 printable parameter to home.php, 3 productid or 4 mode parameter to product.php, 5 id parameter to errormessage.php, 6 section parameter to help.php, 7 mode...

CVE-2005-1822

Qualiteam X-Cart 4.0.8 is affected by multiple SQL injection vulnerabilities. The issues allow remote attackers to execute arbitrary SQL commands via various parameters (home.php: cat, printable; product.php: productid, mode; error_message.php: id; help.php: section; orders.php: mode; register.ph...

CVE-2005-1823

CVE-2005-1823 refers to multiple cross-site scripting (XSS) flaws in Qualiteam X-Cart 4.0.8. The provided documents specify vulnerable vectors within X-Cart’s PHP files, including parameters to home.php (cat, printable), product.php (productid, mode), error_message.php (id), help.php (section), o...

Qualiteam X-Cart 4.0.8 - orders.php?mode Cross-Site Scripting

Qualiteam X-Cart 4.0.8 - orders.php?mode Cross-Site Scripting source: https://www.securityfocus.com/bid/13817/info X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These...

Qualiteam X-Cart 4.0.8 - 'help.php?section' SQL Injection

source: https://www.securityfocus.com/bid/13817/info X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These vulnerabilities could permit remote attackers to pass malicious inpu...

Qualiteam X-Cart 4.0.8 - 'orders.php?mode' SQL Injection

source: https://www.securityfocus.com/bid/13817/info X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These vulnerabilities could permit remote attackers to pass malicious inpu...

Qualiteam X-Cart 4.0.8 - giftcert.php Multiple SQL Injections

Qualiteam X-Cart 4.0.8 - giftcert.php Multiple SQL Injections source: https://www.securityfocus.com/bid/13817/info X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These...

Qualiteam X-Cart Multiple Script perl_binary Parameter Arbitrary Command Execution

The remote host is running Qualiteam X-Cart - a shopping cart software written in PHP. There is a bug in this software that could allow an attacker to execute arbitrary commands on the remote web server with the privileges of the web user. In addition to this, there are some flaws that could allo...