high7.5Public exploit code
CVE-2014-8306
SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands vi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cart Engine 3.0 - Multiple Vulnerabilities2014-09-25 · webapps · php
Impact
SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the item_id variable, as demonstrated by the (1) item_id[0] or (2) item_id[] parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| C97 | Cart Engine | through 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2014/Sep/55
- http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect
- http://seclists.org/fulldisclosure/2014/Sep/55
- http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect