CVE-2007-3323

CVE-2007-3323 describes an SQL injection in Comersus Shop Cart 7.07, exploitable via the idProduct parameter to comersus_optReviewReadExec.asp. Remote attackers could execute arbitrary SQL commands; the description notes it may be the same issue as CVE-2005-2190. No remediation or version-specifi...

CVE-2005-2190

CVE-2005-2190 concerns multiple SQL injection flaws in Comersus Shop Cart. Remote attackers can inject via (1) email to comersus_optAffiliateRegistrationExec.asp or (2) idProduct to comersus_optReviewReadExec.asp, potentially executing arbitrary SQL on the database. The NVD notes a Base Score of ...

CVE-2007-3324

CVE-2007-3324 documents multiple XSS vulnerabilities in Comersus Cart 7.07, enabling remote attackers to inject arbitrary script or HTML via the redirectUrl parameter to comersus_customerAuthenticateForm.asp or comersus_message.asp. The description notes these are different vectors than CVE-2004-...

CVE-2004-1656

CRLF injection in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting via the redirecturl parameter, enabling modification of server HTML content. Root cause is CRLF handling in the redirecturl flow; vulnerable component is the redirecturl parameter processing...

CVE-2005-1188

CVE-2005-1188 involves a cross-site scripting (XSS) vulnerability in Comersus Cart, specifically in the comersus_searchItem.asp script. Affected versions range from 3.90 to 4.51. The underlying issue is insufficient sanitization of the curPage parameter, enabling remote attackers to inject arbitr...

CVE-2004-0681

CVE-2004-0681 involves multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 5.09. The affected pages are comersus_customerAuthenticateForm.asp, comersus_backoffice_message.asp, comersus_supportError.asp, and comersus_message.asp. The underlying issue is non-sanitized input in the ...

CVE-2004-0682

CVE-2004-0682 affects Comersus Cart 5.09 (and possibly earlier versions before 5.098). The issue arises in comersus_gatewayPayPal.asp where remote attackers can change item prices by directly modifying them in the URL. The available connected records confirm the vulnerable component and the URL-b...

CVE-2005-2191

CVE-2005-2191 concerns multiple XSS vulnerabilities in Comersus shopping cart. The flaws allow remote attackers to inject arbitrary web script or HTML via the name parameter in comersus_backoffice_listAssignedPricesToCustomer.asp or the message parameter in comersus_backoffice_message.asp. This r...

CVE-2005-1010

The CVE-2005-1010 vulnerability is a Cross-Site Scripting (XSS) flaw in Comersus Cart 6 that allows remote attackers to inject arbitrary HTML/JS via the Account Username field. Root cause: improper sanitization of user input in the Username field (as detailed in Nessus/NGD references). Impact: us...