Brooky CubeCart < 2.0.7 Multiple Script SQL Injection
High Nessus Network Monitor Plugin ID 2801
SynopsisThe remote web server contains a script that is vulnerable to a SQL injection attack.
DescriptionThe remote host is using Brooky CubeCart, an online storefront application written in PHP. This version of CubeCart is vulnerable to multiple remote SQL injection flaws. An attacker exploiting these flaws would send a malformed HTTP request to the application. Successful exploitation would result in viewing of confidential data, modification of confidential data, and potentially arbitrary code execution. The flawed PHP scripts are 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php'
SolutionUpgrade to version 2.0.7 or higher..