| Package | Affected versions | Patched versions |
|---|---|---|
| zen cart | = 1.2.0d= 1.2.1_patch1= 1.2.1d= 1.2.2d= 1.2.3d= 1.2.4.1= 1.2.4d= 1.2.5d= 1.2.6d= 1.3= 1.3.2= 1.3.5= 1.3.6= 1.3.7= 1.3.8= 1.3.8a |
Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free