CVE-2007-2862: SQL Injection

Published May 24, 2007

Updated

Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie modification.

Affected Software

1 affected component

Devellion CubeCart=3.0.16

Event History

May 24, 2007

CVE Published

07:30 PM

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2862?

CVE-2007-2862 is considered a high-severity vulnerability due to its potential for arbitrary SQL command execution.

How do I fix CVE-2007-2862?

To fix CVE-2007-2862, upgrade to a newer version of CubeCart that addresses this SQL injection vulnerability.

What software is affected by CVE-2007-2862?

CVE-2007-2862 specifically affects CubeCart version 3.0.16.

What types of attacks can CVE-2007-2862 enable?

CVE-2007-2862 can enable attackers to execute arbitrary SQL commands, potentially compromising the database.

Where in the code does CVE-2007-2862 originate?

CVE-2007-2862 originates from missing input sanitization related to the $option variable in the cart.inc.php file.