Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that 1 set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and 2 grant...

CVE-2011-5011

CVE-2011-5011 affects xt:Commerce 3.0.4 SP2.1 and earlier. The issue is CSRF that lets remote attackers hijack Admin sessions by manipulating the cID parameter in two admin endpoints: statusconfirm in admin/customers.php (set a new user to Admin) and save in admin/accounting.php (grant permission...

CVE-2011-5011

Multiple cross-site request forgery CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that 1 set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and 2 grant...

CVE-2010-4954

SQL injection vulnerability in productreviewsinfo.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the productsid parameter...

Sql injection

SQL injection vulnerability in productreviewsinfo.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2010-4954

SQL injection vulnerability in productreviewsinfo.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2010-4954

The CVE-2010-4954 entry describes an SQL injection in xt:Commerce Gambio 2008, specifically in the product_reviews_info.php handler. The vulnerability is triggered via the products_id parameter, allowing remote attackers to inject and execute arbitrary SQL commands. Affected software is xt:Commer...

HTB22877: Path disclosure in xt:Commerce

Vulnerability ID: HTB22877 Reference: http://www.htbridge.ch/advisory/pathdisclosureinxtcommerce.html Product: xt:Commerce Vendor: xt:Commerce GmbH http://www.xt-commerce.com/ Vulnerable Version: VEYTON 4.0.13 Vendor Notification: 01 March 2011 Vulnerability Type: Path disclosure Status: Fixed by...

Installation Path Disclosure Weakness in xt:Commerce

High-Tech Bridge SA Security Research Lab has discovered a weakness in xt:Commerce which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in xt:Commerce The weakness exists due to application reveals the full path to installation...

xt:Commerce 3.x Second Order SQL Injection

xt:Commerce 3.X Second Order SQL Injection Vulnerability xtcvalidateemail felix |at| malloc.im =============================================================================== Overview: xt:Commerce 3 is an open source shopping software based on osCommerce. It is vulnerable to a second order SQL...

XT:Commerce <= 3.04 SP2.1 XSS Vulnerability

Exploit for php platform in category web applications =========================================== XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the attack...

XT:Commerce Cross Site Scripting

---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the...

XT:Commerce < 3.04 SP2.1 - Cross-Site Scripting

---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the...

XT:Commerce 3.04 SP2.1 - Cross-Site Scripting

XT:Commerce 3.04 SP2.1 - Cross-Site Scripting ---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be...

xt:Commerce Shopsoftware Arbitrary File Upload

============================================================= xt:Commerce Shopsoftware fckeditor File Upload Vulnerability ============================================================= Exploit Title: xt:Commerce Shopsoftware fckeditor Date: 08/11/2010 Author: Net.Edit0r Software Link:...

xt:Commerce Shopsoftware (fckeditor) Arbitrary File Upload

Exploit for php platform in category web applications ========================================================== xt:Commerce Shopsoftware fckeditor Arbitrary File Upload ========================================================== Exploit Title: xt:Commerce Shopsoftware fckeditor Date: 08/11/2010...

xt:Commerce Shopsoftware 34 - FCKeditor Arbitrary File Upload

xt:Commerce Shopsoftware 34 - FCKeditor Arbitrary File Upload ============================================================= xt:Commerce Shopsoftware fckeditor File Upload Vulnerability ============================================================= Exploit Title: xt:Commerce Shopsoftware fckeditor...

xt:Commerce Shopsoftware 3/4 - 'FCKeditor' Arbitrary File Upload

============================================================= xt:Commerce Shopsoftware fckeditor File Upload Vulnerability ============================================================= Exploit Title: xt:Commerce Shopsoftware fckeditor Date: 08/11/2010 Author: Net.Edit0r Software Link:...

xt:Commerce Gambio 2008-2010 ERROR Based (reviews.php) SQL Injection

Exploit for php platform in category web applications ====================================================================== xt:Commerce Gambio 2008 - 2010 ERROR Based reviews.php SQL Injection ====================================================================== Exploit Title: xt:Commerce Gambi...

xt:Commerce Gambio 2008 2010 - reviews.php Error-Based SQL Injection

xt:Commerce Gambio 2008 2010 - reviews.php Error-Based SQL Injection / / / / / / / / / / // / / / / ///// // Exploit Title: xt:Commerce Gambio 2008 - 2010 ERROR Based SQL Injection "reviews.php" Date: 2010-09-18 Author: secret Contact : [email protected] / ICQ : 17-33-77 Site :...