PT-2010-5319

CVE-2010-4147

·

Published

2010-11-01

·

Updated

2017-08-17

Description by

CVSS 2.0
7.5
High
MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Pentasoft Avactis Shopping Cart versions 1.9.1 build 8356 and earlier
Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved by sending a malicious User-Agent header to specific API endpoints, such as "index.php" and "product-list.php".
Recommendations For versions 1.9.1 build 8356 and earlier, update to a version that contains a fix for this issue.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2010-4147
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com