Searching midicart software vulnerabilities

MidiCart PHP 1 allows remote attackers to (1) u

attackers | MidiCart | remote | allows | PHP |

MidiCart PHP 1 allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.


MidiCart (1) PHP, (2) PHP Plus, and (3) PHP Max

MidiCart |

MidiCart (1) PHP, (2) PHP Plus, and (3) PHP Maxi does not restrict access to files in the /admin/ directory, which allows remote attackers to (1) steal sensitive information via to /admin/credit_card_info.php or (2) upload unauthorized files via /admin/upload.php.


MidiCart PHP Shopping Cart allows remote attack

information | attackers | sensitive | MidiCart | Shopping | request | direct | obtain | allows | remote | Cart | PHP | via |

MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to (1) search_list.php, (2) item_list.php, or (3) item_show.php, which reveal the path in a PHP error message.


Cross-site scripting (XSS) vulnerability in Mid

Cross-site | scripting |

Cross-site scripting (XSS) vulnerability in MidiCart PHP Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) searchstring parameter to search_list.php or the (2) secondgroup or (3) maingroup parameters to item_list.php.


Multiple SQL injection vulnerabilities in MidiC

vulnerabilities | arbitrary | attackers | injection | Shopping | Multiple | MidiCart | commands | execute | remote | allow | Cart | via | SQL | PHP |

Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) searchstring parameter to search_list.php, the (2) maingroup or (3) secondgroup parameters to item_list.php, or (4) code_no parameter to item_show.php.


SQL injection vulnerability in MidiCart allows

vulnerability | attackers | parameter | arbitrary | injection | commands | MidiCart | code_no | execute | remote | allows | SQL | via |

SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the code_no parameter to (1) Item_Show.asp or (2) search_list.asp.


Multiple SQL injection vulnerabilities in MidiC

vulnerabilities | arbitrary | attackers | injection | Shopping | Multiple | MidiCart | commands | execute | remote | allow | Cart | Plus | via | SQL | ASP |

Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) id2006quant parameter to (a) item_show.asp, or the (2) maingroup or (3) secondgroup parameter to (b) item_list.asp. NOTE: the code_no parameter to Item_Show.asp is covered by CVE-2005-2601.


Unrestricted file upload vulnerability in admin

vulnerability | authenticated | admin/addphp | Unrestricted | arbitrary | directory | possibly | Midicart | images/ | upload | allows | remote | under | other | users | files | root | file | php | web |

Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.


viewcart in Midicart accepts negative numbers i

negative | Midicart | viewcart | numbers | accepts | Qty |

viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.


Software vulnerabilities results 1 to 10 of 10     
Page: 1