SQL Injection Vulnerability in Zen Cart by Zen Cart
CVE-2008-6985

Currently unrated

Key Information:

Vendor

Zen-cart

Status
Zen Cart
Vendor
CVE Published:
19 August 2009

What is CVE-2008-6985?

Zen Cart has several SQL injection vulnerabilities within the shopping_cart.php file, impacting versions 1.2.0 through 1.3.8a. When the magic_quotes_gpc feature is turned off, these vulnerabilities enable remote attackers to inject arbitrary SQL commands via the 'id' parameter during the actions of adding or updating items in the shopping cart. As a result, unauthorized users can manipulate database queries and potentially extract sensitive information, underscoring the importance of employing proper coding practices and applying updates to address these security flaws.

References

http://www.securityfocus.com/archive/1/496002/100/0/threaded
mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilities/44917
vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/496032/100/100/thr...
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.