PT-2015-5647 · Zeuscart · Zeuscart

Steffen Rösemann · Published 2015-03-10 · Updated 2015-07-28 · CVE-2015-2183

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZeusCart version 4

Description The issue concerns SQL injection vulnerabilities in the administrative backend. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. This can be achieved through the id parameter in either a disporders detail or subadminmgt edit action, or the cid parameter in an editcurrency action to admin/.

Recommendations For ZeusCart version 4, avoid using the id parameter in disporders detail or subadminmgt edit actions and the cid parameter in editcurrency actions to admin/ until a fix is available. As a temporary workaround, consider restricting access to these parameters to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-2183

Affected Products

Zeuscart

References · 11

• 🔥 https://exploit-db.com/exploits/36159 · Exploit
• 🔥 http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 http://exploit-db.com/exploits/36159 · Exploit
• 🔥 http://seclists.org/oss-sec/2015/q1/649 · Exploit
• 🔥 http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html · Exploit
• 🔥 http://securityfocus.com/bid/72761 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2183 · Security Note
• https://github.com/ZeusCart/zeuscart/issues/28 · Note
• http://seclists.org/fulldisclosure/2015/Feb/89 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2183 · Note
• http://seclists.org/oss-sec/2015/q1/727 · Note