CVE-2006-4214: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via 1 GPC data to the ipngetstoredsession function in ipnmainhandler.php, which can be leveraged to modify elements of $SESSION; and allow remote authenticated users to...

CVE-2006-4218: Undefined Security Weakness

Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter...

[SA21484] Zen Cart SQL Injection and File Inclusion Vulnerabilities

---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation...

CVE-2006-4215: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig9990loadFile parameter...

Zen Cart Web Shopping Cart 1.3.0.2 - autoload_func.php?autoLoadConfig[999][0][loadFile] Remote File Inclusion

Zen Cart Web Shopping Cart 1.3.0.2 - autoloadfunc.php?autoLoadConfig9990loadFile Remote File Inclusion source: https://www.securityfocus.com/bid/19543/info Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An...

Zen Cart Web Shopping Cart 1.3.0.2 - 'autoload_func.php?autoLoadConfig[999][0][loadFile]' Remote File Inclusion

source: https://www.securityfocus.com/bid/19543/info Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to include arbitrary remote and local files containing malicious PHP cod...

CVE-2006-3757

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...

CVE-2006-3757

CVE-2006-3757 affects Zen Cart 1.3.0.2. The vulnerability in index.php allows remote attackers to obtain sensitive information by passing empty (GET, SESSION, POST, COOKIE, SESSION) parameters, causing an error message that reveals the installation path. The description notes this may stem from a...

CVE-2006-3757

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...

CVE-2006-3757: Undefined Security Weakness

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...

Zen-Cart 1.3.0.2 Full Path Disclosure

Zen-Cart 1.3.0.2 En: Zen-Cart .. E-commerce PHP Program - This Bug Can Tell U Where The Program @ Server Ar: .. Full Path Disclosure :- /index.php?GET= /index.php?SESSION= /index.php?POST= /index.php?COOKIE= /index.php?SESSION= /------------------------------------------/...

Design/Logic Flaw

Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests...

Sql injection

SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection...

CVE-2006-0698

Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection...

CVE-2006-0696

SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-0697

Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests...

CVE-2006-0696

Zen Cart SQL injection vulnerability (CVE-2006-0696) affects versions before 1.2.7. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. No exploit details are provided in the connected documents; remediation/patch information is not stated. If upgrading, v...

CVE-2006-0698

CVE-2006-0698 affects Zen Cart prior to version 1.2.7. The vulnerability is described as unspecified vulnerabilities allowing remote attackers to cause unknown impact via unspecified vectors (other than SQL injection). The connected documents do not provide concrete exploit details, concrete root...

CVE-2006-0697

Zen Cart before 1.2.7 is affected by CVE-2006-0697 due to insufficient protection of the admin/includes directory. The vulnerability, described in the NVD entry, allows remote attackers to trigger unknown impact via unspecified vectors (likely direct requests) with a CVSS v2 base score of 10.0 (H...