SQL Injection Vulnerability in Zen Cart by Zen Cart Development
CVE-2008-6986

Currently unrated

Key Information:

Vendor

Zen-cart

Status
Zen Cart
Vendor
CVE Published:
19 August 2009

What is CVE-2008-6986?

An SQL injection vulnerability exists in the actionMultipleAddProduct function of Zen Cart's shopping_cart.php file. This flaw allows attackers to execute arbitrary SQL commands remotely when the magic_quotes_gpc setting is disabled. By exploiting the products_id array parameter during the multiple_products_add_product action, attackers can manipulate the database and potentially gain unauthorized access to sensitive information.

References

http://www.securityfocus.com/archive/1/496002/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/48347
vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/archive/1/496032/100/100/thr...
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.