CVE-2009-2579

2009-08-0519:30:01

CWE-89

[email protected]

web.nvd.nist.gov

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

7.7

Confidence

Low

EPSS

0.003

Percentile

70.0%

JSON

SQL injection vulnerability in reward_points.post.php in the Reward points addon in CS-Cart before 2.0.6 allows remote authenticated users to execute arbitrary SQL commands via the sort_order parameter in a reward_points.userlog action to index.php, a different vulnerability than CVE-2005-4429.2.

Affected configurations

Nvd

Node

cs-cartcs-cartRange≤2.0.5

cs-cartcs-cartMatch1.1

cs-cartcs-cartMatch1.2

cs-cartcs-cartMatch1.3.0

cs-cartcs-cartMatch1.3.2

cs-cartcs-cartMatch1.3.2sp2

cs-cartcs-cartMatch1.3.2sp2trial_edition

cs-cartcs-cartMatch1.3.3

cs-cartcs-cartMatch1.3.5beta

cs-cartcs-cartMatch1.3.5sp4

cs-cartcs-cartMatch1.3.5sp2

cs-cartcs-cartMatch1.3.5sp3

cs-cartcs-cartMatch2.0

cs-cartcs-cartMatch2.0beta

cs-cartcs-cartMatch2.0beta2

cs-cartcs-cartMatch2.0beta3

cs-cartcs-cartMatch2.0rc

cs-cartcs-cartMatch2.0.4

VendorProductVersionCPE
cs-cartcs-cart*cpe:2.3:a:cs-cart:cs-cart:*:*:*:*:*:*:*:*
cs-cartcs-cart1.1cpe:2.3:a:cs-cart:cs-cart:1.1:*:*:*:*:*:*:*
cs-cartcs-cart1.2cpe:2.3:a:cs-cart:cs-cart:1.2:*:*:*:*:*:*:*
cs-cartcs-cart1.3.0cpe:2.3:a:cs-cart:cs-cart:1.3.0:*:*:*:*:*:*:*
cs-cartcs-cart1.3.2cpe:2.3:a:cs-cart:cs-cart:1.3.2:*:*:*:*:*:*:*
cs-cartcs-cart1.3.2cpe:2.3:a:cs-cart:cs-cart:1.3.2:sp2:*:*:*:*:*:*
cs-cartcs-cart1.3.2cpe:2.3:a:cs-cart:cs-cart:1.3.2:sp2:trial_edition:*:*:*:*:*
cs-cartcs-cart1.3.3cpe:2.3:a:cs-cart:cs-cart:1.3.3:*:*:*:*:*:*:*
cs-cartcs-cart1.3.5cpe:2.3:a:cs-cart:cs-cart:1.3.5:beta:*:*:*:*:*:*
cs-cartcs-cart1.3.5cpe:2.3:a:cs-cart:cs-cart:1.3.5:sp4:*:*:*:*:*:*

Vendor	Product	Version	CPE
cs-cart	cs-cart	*	cpe:2.3:a:cs-cart:cs-cart::::::::
cs-cart	cs-cart	1.1	cpe:2.3:a:cs-cart:cs-cart:1.1:::::::*
cs-cart	cs-cart	1.2	cpe:2.3:a:cs-cart:cs-cart:1.2:::::::*
cs-cart	cs-cart	1.3.0	cpe:2.3:a:cs-cart:cs-cart:1.3.0:::::::*
cs-cart	cs-cart	1.3.2	cpe:2.3:a:cs-cart:cs-cart:1.3.2:::::::*
cs-cart	cs-cart	1.3.2	cpe:2.3:a:cs-cart:cs-cart:1.3.2:sp2::::::
cs-cart	cs-cart	1.3.2	cpe:2.3:a:cs-cart:cs-cart:1.3.2:sp2:trial_edition:::::*
cs-cart	cs-cart	1.3.3	cpe:2.3:a:cs-cart:cs-cart:1.3.3:::::::*
cs-cart	cs-cart	1.3.5	cpe:2.3:a:cs-cart:cs-cart:1.3.5:beta::::::
cs-cart	cs-cart	1.3.5	cpe:2.3:a:cs-cart:cs-cart:1.3.5:sp4::::::