CVE-2010-4147 Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header t...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to (1) index.php and (2) product-list.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avactis shopping cart | <= 1.9.1 | No fix listed |
| avactis shopping cart | = 1.8.0 | No fix listed |
| avactis shopping cart | = 1.8.1 | No fix listed |
| avactis shopping cart | = 1.8.2 | No fix listed |
| avactis shopping cart | = 1.9.0 | No fix listed |
References
- holisticinfosec.org
- 41764 third-party-advisory vendor-advisory
- www.avactis.com patch
- 68646 vdb-entry
- 68647 vdb-entry
- 44104 vdb-entry
- avactis-useragent-sql-injection(62559) vdb-entry