HIGH🇬🇧 English

CVE-2008-6394

CVSS 7.5v2.0pub. 2009-03-04upd. 2026-04-23

SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cs_cookies[customer_user_id] cookie parameter.

oryginał EN
CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Cs Cart

    APP
    Cs-Cart
    1.11.21.3.01.3.21.3.3≤ 1.3.5
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLi
CWE
Referencje

Powiązane podatności

CVE-2025-50850HIGH8.6ten sam produkt

An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security contr...

CVE-2017-15673HIGH7.2ten sam produkt

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbi...

CVE-2017-2138HIGH8.8ten sam produkt

Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 ...

CVE-2016-4862HIGH8.8ten sam produkt

Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier a...

CVE-2009-4891HIGH7.5ten sam produkt

SQL injection vulnerability in index.php in CS-Cart 2.0.0 Beta 3 allows remote attackers to execute arbitrary ...