CVE-2006-4214 - Secunia Advisories - Vulnerability Intelligence

CVE Reference: CVE-2006-4214
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-4214

Description: Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session function in ipn_main_handler.php, which can be leveraged to modify elements of $_SESSION; and allow remote authenticated users to execute arbitrary SQL commands via (2) a session id within a cookie to whos_online_session_recreate, (3) the quantity field to the add_cart function, (4) an id[] parameter when adding an item to a shopping cart, or (5) a redemption code when checking out (dc_redeem_code parameter to includes/modules/order_total/ot_coupon.php).

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/28393 SAID Secunia Advisory: SA21484 OSVDB 28147 28146 28145 28144 28148 MISC http://www.gulftech.org/?node=research&article_id=00109-08152006 CONFIRM http://www.zen-cart.com/forum/showthread.php?t=43579 BID 19542

Return to the previous page.