Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-8305.
AI-analyzed exploit summary The provided exploit code demonstrates multiple vulnerabilities in Cart Engine 3.0, including SQL injection via unsanitized 'item_id' parameters, reflected XSS through unneutralized output, and open redirect via untrusted HTTP Referer header. The PoC includes detailed HTTP requests for each vulnerability type.
Description
Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to (1) index.php, (2) cart.php, (3) msg.php, or (4) page.php.
Exploits (1)
The provided exploit code demonstrates multiple vulnerabilities in Cart Engine 3.0, including SQL injection via unsanitized 'item_id' parameters, reflected XSS through unneutralized output, and open redirect via untrusted HTTP Referer header. The PoC includes detailed HTTP requests for each vulnerability type.