Description
Multiple SQL injection vulnerabilities in WebAsyst Shop-Script FREE allow attackers to execute arbitrary SQL commands via the (1) add2cart, (2) c_id, (3) categoryID, (4) list_price, (5) name, (6) new_offer, (7) price, (8) product_code, (9) productID, (10) rating, and (11) save_product parameters.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/510741/100/0/threaded
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0882
Vendor Advisory x_refsource_misc
http://www.vupen.com/english/research-web.php
Scores
EPSS
0.0125
EPSS Percentile
66.2%
Details
CWE
CWE-89
Status
published
Products (1)
webasyst_llc/shop-script
Published
Apr 16, 2010
Tracked Since
Feb 18, 2026