PT-2007-4166 · Cubecart · Cubecart

Published 2007-05-24 · Updated 2018-10-16 · CVE-2007-2862

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CubeCart version 3.0.16

Description The issue is related to multiple SQL injection vulnerabilities. These vulnerabilities might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory. The problem is related to missing sanitization of the $option variable and possibly cookie modification.

Recommendations For CubeCart version 3.0.16, consider sanitizing the $option variable to prevent SQL injection attacks. As a temporary workaround, restrict access to the cart.inc.php file and other affected files in the include directory to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-2862

Affected Products

Cubecart

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-2862 · Security Note
• http://securityfocus.com/archive/1/469301/100/0/threaded · Note
• http://securityfocus.com/bid/24100 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2862 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34460 · Note
• http://osvdb.org/38100 · Note
• http://securityreason.com/securityalert/2730 · Note