Sql injection

2014-10-1619:55:00

PRIOn knowledge base

www.prio-n.com

9.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

49.1%

JSON

SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the item_id variable, as demonstrated by the (1) item_id[0] or (2) item_id[] parameter.

CPENameOperatorVersion
cart_enginele3.0

CPE	Name	Operator	Version
	cart_engine	le	3.0

References

seclists.org/fulldisclosure/2014/Sep/55

www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect