CVE-2005-1398
phpcart 3.2-4.6.4 - Unauthenticated Price Manipulation via Price and Postage Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-1398. PoCs published by Lostmon.
AI-analyzed exploit summary This exploit demonstrates a parameter manipulation vulnerability in PHPCart, allowing an attacker to alter invoice and payment charges by modifying URI parameters such as 'price' and 'quantity'. The issue arises due to insufficient input validation in the application.
Description
phpcart.php in PHPCart 3.2 allows remote attackers to change product price information by modifying the (1) price or (2) postage parameters. NOTE: it was later reported that 3.4 through 4.6.4 are also affected.
Exploits (1)
This exploit demonstrates a parameter manipulation vulnerability in PHPCart, allowing an attacker to alter invoice and payment charges by modifying URI parameters such as 'price' and 'quantity'. The issue arises due to insufficient input validation in the application.