Description

The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.

Remediation

References

CVE-2013-1465

Related Vulnerabilities

Mailman Other Vulnerability (CVE-2004-1143)

WordPress Plugin Google Analytics Dashboard Plugin for WordPress by MonsterInsights Multiple Cross-Site Scripting Vulnerabilities (4.2.4)

WordPress Plugin Stetic Cross-Site Request Forgery (1.0.6)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-35474)

Sqlite NULL Pointer Dereference Vulnerability (CVE-2019-19926)

Severity

High

Classification

CVE-2013-1465 CWE-20

Tags

Missing Update Known Vulnerabilities