PT-2010-5319 · Pentasoft · Pentasoft Avactis Shopping Cart

Published 2010-11-01 · Updated 2017-08-17 · CVE-2010-4147

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pentasoft Avactis Shopping Cart versions 1.9.1 build 8356 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved by sending a malicious User-Agent header to specific API endpoints, such as "index.php" and "product-list.php".

Recommendations For versions 1.9.1 build 8356 and earlier, update to a version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-4147

Affected Products

Pentasoft Avactis Shopping Cart

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-4147 · Security Note
• http://secunia.com/advisories/41764 · Vendor Advisory
• http://avactis.com/forums/index.php?showtopic=5317 · Patch
• http://holisticinfosec.org/content/view/159/45 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62559 · Note
• http://securityfocus.com/bid/44104 · Note
• http://osvdb.org/68647 · Note
• http://osvdb.org/68646 · Note