Open Solution

Quick.Cart

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2007-3138

Exploit
  • EPSS 12.76%
  • Veröffentlicht 08.06.2007 16:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Directory traversal vulnerability in index.php in Open Solution Quick.Cart 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an sLanguage cookie, which is used to define a value in config/gener...

6.8

CVE-2007-3139

  • EPSS 17.8%
  • Veröffentlicht 08.06.2007 16:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code.

7.5

CVE-2007-1407

  • EPSS 0.39%
  • Veröffentlicht 10.03.2007 22:19:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Unspecified vulnerability in OpenSolution Quick.Cart before 2.1 has unknown impact and attack vectors, related to a "low critical exploit."

6.8

CVE-2006-6390

Exploit
  • EPSS 7.55%
  • Veröffentlicht 08.12.2006 01:28:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db_t...

6.8

CVE-2006-6391

Exploit
  • EPSS 2.71%
  • Veröffentlicht 08.12.2006 01:28:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include arbitrary files via a .. (dot dot) in the config[db_type] parameter to ...

4.3

CVE-2005-1587

Exploit
  • EPSS 0.53%
  • Veröffentlicht 14.05.2005 04:00:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Cross-site scripting (XSS) vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to inject arbitrary web script or HTML via the sWord parameter.

7.5

CVE-2005-1588

Exploit
  • EPSS 0.72%
  • Veröffentlicht 11.05.2005 04:00:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

SQL injection vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to execute arbitrary SQL commands via the iCategory parameter. NOTE: the vendor has privately disputed this issue, saying that Quick.cart does not even use SQL and...