Zeuscart v.4 /admin/classes/Core/COrderManagement.php SQL注入漏洞

该漏洞出现在对参数传递内容没有进行过滤和转义导致的SQL注入，下面对代码进行详细分析。 首先在COrderManagement.php的第62行 $name=$POST'dispname'; $shipname=$POST'shipname'; $orderid=$POST'orderid'; $fromdate=$POST'txtfromdate'; $todate=$POST'txttodate'; $orderdate=$POST'orderdate'; $billname=$POST'billname'; $ordertotalto=$POST'ordertotalto';...

Zeuscart 4.0 - Multiple Vulnerabilities

Zeuscart 4.0 - Multiple Vulnerabilities Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Advisory ID: SROEADV-2015-12 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will ask...

Zeuscart 4 Cross Site Scripting / SQL Injection

Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Advisory ID: SROEADV-2015-12 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assigned after release on...

Zeuscart v.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assign...