icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

Brooky CubeCart < 2.0.7 Multiple Script SQL Injection

High

Synopsis

The remote web server contains a script that is vulnerable to a SQL injection attack.

Description

The remote host is using Brooky CubeCart, an online storefront application written in PHP. This version of CubeCart is vulnerable to multiple remote SQL injection flaws. An attacker exploiting these flaws would send a malformed HTTP request to the application. Successful exploitation would result in viewing of confidential data, modification of confidential data, and potentially arbitrary code execution. The flawed PHP scripts are 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php'

Solution

Upgrade to version 2.0.7 or higher..