CVE-2008-3768 Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an...
HighCVSS 7.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an edit_registry action to index.php, (2) a vector involving the check_email function, and other vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| turnkeywebtools sunshop shopping cart | <= 4.1.4 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.0 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.1 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.2 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.3 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.4 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.5 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.6 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.7 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.8 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.0.9 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.1.0 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.1.1 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.1.2 | No fix listed |
| turnkeywebtools sunshop shopping cart | = 4.1.3 | No fix listed |
References
- demos.turnkeywebtools.com
- 31539 patch third-party-advisory vendor-advisory
- 4180 third-party-advisory
- www.gulftech.org exploit
- 20080818 SunShop <= 4.1.4 SQL Injection mailing-list
- 30751 vdb-entry
- sunshopshoppingcart-classajax-sql-injection(44553) vdb-entry
- 6273 exploit