Description

Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

Remediation

References

CVE-2008-6985

Related Vulnerabilities

Internet Information Services Other Vulnerability (CVE-2006-0026)

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.17)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-1849)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2011-4833)

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-17960)

Severity

Medium

Classification

CVE-2008-6985 CWE-138

Tags

Missing Update Known Vulnerabilities