NetSight
IP …
medium6.8Public exploit code

CVE-2008-6985

Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

Affected products

VendorProductAffected versions
Zen-CartZen Cart
Versions 1.2.0d, 1.2.1_patch1, 1.2.1d, 1.2.2d, 1.2.3d, 1.2.4.1

Weakness classification

CWE-89

References