xt:Commerce Gambio 2008 < 2010 - 'reviews.php' Error-Based SQL Injection

/ / / / / / / / / / // / / / / ///// // Exploit Title: xt:Commerce Gambio 2008 - 2010 ERROR Based SQL Injection "reviews.php" Date: 2010-09-18 Author: secret Contact : [email protected] / ICQ : 17-33-77 Site : swissfaking.net/board Software Link: http://www.gambio.de/ Version: 2006 - 2008...

CVE-2010-1359

SQL injection vulnerability in bluegateseo.inc.php in the Direct URL module for xt:Commerce, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from...

Sql injection

SQL injection vulnerability in bluegateseo.inc.php in the Direct URL module for xt:Commerce, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2010-1359

The CVE-2010-1359 issue affects xt:Commerce, specifically the Direct URL module’s bluegate_seo.inc.php. When magic_quotes_gpc is disabled, an input vector via the coID parameter enables SQL injection, allowing remote attackers to execute arbitrary SQL commands. The vulnerability is described cons...

CVE-2010-1359

SQL injection vulnerability in bluegateseo.inc.php in the Direct URL module for xt:Commerce, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from...

Sql injection

SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.1, when magicquotesgpc is enabled and the SEO URLs are activated, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2008-6304

SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.1, when magicquotesgpc is enabled and the SEO URLs are activated, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2008-6304

SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.1, when magicquotesgpc is enabled and the SEO URLs are activated, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2008-6304

This CVE concerns xt:Commerce prior to version 3.0.4 Sp2.1. The vulnerability is a SQL injection that arises when magic_quotes_gpc is enabled and SEO URLs are active, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact is partial confidentiality, integrity,...

Session fixation

Session fixation vulnerability in shoppingcart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setting the XTCsid parameter...

CVE-2008-6044

Cross-site scripting XSS vulnerability in advancedsearchresult.php in xt:Commerce 3.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter...

CVE-2008-6045

Session fixation vulnerability in shoppingcart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setting the XTCsid parameter...

CVE-2008-6044

Cross-site scripting XSS vulnerability in advancedsearchresult.php in xt:Commerce 3.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter...

CVE-2008-6045

The CVE-2008-6045 entry concerns a session fixation flaw in xt:Commerce versions 3.0.4 and earlier, specifically in shopping_cart.php where an attacker can set the XTCsid parameter to hijack a user session. Affected component is the shopping_cart.php logic within xt:Commerce 3.0.4 and earlier. Im...

CVE-2008-6044

CVE-2008-6044 is an XSS vulnerability in xt:Commerce 3.0.4 and earlier, exploitable via the keywords parameter in advanced_search_result.php. The connected documents confirm the affected product/version and the injection of arbitrary script/HTML, with data indicating impact solely as cross-site s...

[MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues

MajorSecurity Advisory 54xt:Commerce - Cross Site Scripting and Session Fixation Issues Details ======= Product: xt:Commerce Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.xtcommerce-shop.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered...

major_rls54.txt

MajorSecurity Advisory 54xt:Commerce - Cross Site Scripting and Session Fixation Issues Details ======= Product: xt:Commerce Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.xtcommerce-shop.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered...

xt:Commerce 3.04 - XTCsid Session Fixation

xt:Commerce 3.04 - XTCsid Session Fixation source: https://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a...

xt:Commerce 3.04 - advanced_search_result.php?keywords Cross-Site Scripting

xt:Commerce 3.04 - advancedsearchresult.php?keywords Cross-Site Scripting source: https://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the...

xt:Commerce 3.04 - 'advanced_search_result.php?keywords' Cross-Site Scripting

source: https://www.securityfocus.com/bid/31313/info xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability. An attacker can leverage the session-fixation issue to hijack a session of an unsuspecting user. The attacker...