PT-2005-4489 · Unknown · E-Quick Cart

Published 2005-11-22 · Updated 2011-03-08 · CVE-2005-3735

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions e-Quick Cart (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerable parameters are productid in "shopaddtocart.asp", strpemail in "shopprojectlogin.asp", and id in "shoptellafriend.asp".

Recommendations To resolve the issue, consider temporarily restricting access to the vulnerable API endpoints "shopaddtocart.asp", "shopprojectlogin.asp", and "shoptellafriend.asp" until a patch is available. Avoid using the parameters productid, strpemail, and id in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-3735

Affected Products

E-Quick Cart

References · 8

• 🔥 http://securitytracker.com/id?1015244 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3735 · Security Note
• http://secunia.com/advisories/17652 · Vendor Advisory
• http://osvdb.org/20998 · Note
• http://vupen.com/english/advisories/2005/2506 · Note
• http://osvdb.org/20997 · Note
• http://osvdb.org/20999 · Note
• http://securityfocus.com/bid/15510 · Note