Description

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.

Remediation

References

CVE-2008-6986

Related Vulnerabilities

WordPress Plugin Fancy Cats Multiple Cross-Site Scripting Vulnerabilities (1.1)

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.10)

Apache HTTP Server Other Vulnerability (CVE-2002-0661)

Apache Tomcat Insufficiently Protected Credentials Vulnerability (CVE-2019-12418)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-1133)

Severity

Medium

Classification

CVE-2008-6986 CWE-138

Tags

Missing Update Known Vulnerabilities