CVEvulnerability
CVE-2010-4632
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-12-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL commands via the (1) article parameter to kb.asp, (2) specific parameter to cart.asp, (3) countrycode parameter to contact.asp, and the (4) srch parameter to search.asp. NOTE: the article parameter to pilot.asp is already covered by CVE-2008-2688.
Affected configurations
• pilotcart pilot cart 7.3
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html Exploit
- http://marc.info/?l=full-disclosure&m=128913521908405&w=2 Exploit
- http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt packetstormsecurity.org
- http://secunia.com/advisories/30176 Vendor Advisory
- http://www.exploit-db.com/exploits/15448 Exploit
- http://www.securityfocus.com/bid/44698 Exploit
- http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html Exploit
- http://marc.info/?l=full-disclosure&m=128913521908405&w=2 Exploit
- http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt packetstormsecurity.org
- http://secunia.com/advisories/30176 Vendor Advisory
- http://www.exploit-db.com/exploits/15448 Exploit
- http://www.securityfocus.com/bid/44698 Exploit