CVE-2013-1465

CRITICAL

Cubecart < 5.2.0 - Insecure Deserialization

Title source: rule
STIX 2.1

Description

The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.

Exploits (1)

exploitdb WRITEUP VERIFIED
by EgiX · textwebappsphp
https://www.exploit-db.com/exploits/24465

References (9)

Core 9
Core References
Broken Link mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-02/0032.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/81920
Exploit x_refsource_misc
http://karmainsecurity.com/KIS-2013-02
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/57770
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/120094/CubeCart-5.2.0-PHP-Object-Injection.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/52072
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/89923
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/24465

Scores

CVSS v3 9.8
EPSS 0.3101
EPSS Percentile 96.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (1)
cubecart/cubecart 5.0.0 - 5.2.0
Published Feb 08, 2013
Tracked Since Feb 18, 2026