PT-2008-2525 · Iscripts · Iscripts Multicart
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
iScripts MultiCart version 2.0
Description
The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the
productid parameter in the "productdetails.php" file.Recommendations
For iScripts MultiCart version 2.0, consider restricting access to the
productid parameter in the "productdetails.php" file until a patch is available. As a temporary workaround, avoid using the productid parameter in the affected file to minimize the risk of exploitation.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Iscripts Multicart