PT-2007-4294 · Salescart · Salescart Shopping Cart

Published 2007-06-04 · Updated 2024-08-07 · CVE-2007-2997

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SalesCart Shopping Cart (affected versions not specified)

Description: The issue concerns SQL injection vulnerabilities in the cgi-bin/reorder2.asp file of SalesCart Shopping Cart, allowing remote attackers to execute arbitrary SQL commands via the password field and other unspecified vectors. The vendor disputes this issue, stating it was reproducible on an old, out-of-date demo but not on the released product.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-2997

Affected Products

Salescart Shopping Cart

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-2997 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34567 · Note
• http://securityfocus.com/archive/1/471415/100/0/threaded · Note
• http://securityfocus.com/archive/1/471409/100/0/threaded · Note
• https://t.me/cvenotify/89664 · Telegram Post
• http://osvdb.org/40145 · Note
• http://securityreason.com/securityalert/2758 · Note
• http://securityfocus.com/bid/24226 · Note
• http://securityfocus.com/archive/1/469900/100/0/threaded · Note