Description

Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

Remediation

References

CVE-2008-6985

Related Vulnerabilities

WordPress Plugin WP User Switch Security Bypass (1.0.2)

WordPress Plugin FlightLog SQL Injection (3.0.2)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4532)

WebLogic Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-14572)

WordPress Plugin Elementor Pro Security Bypass (3.11.6)

Severity

Medium

Classification

CVE-2008-6985 CWE-138

Tags

Missing Update Known Vulnerabilities