CVE-2008-6985: SQL Injection
Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6985?
CVE-2008-6985 is classified as a high severity vulnerability due to the potential for unauthorized SQL command execution.
How do I fix CVE-2008-6985?
To mitigate CVE-2008-6985, it is recommended to patch Zen Cart to the latest version that addresses these SQL injection vulnerabilities.
Which Zen Cart versions are affected by CVE-2008-6985?
CVE-2008-6985 affects Zen Cart versions from 1.2.0 to 1.3.8a, particularly when magic_quotes_gpc is disabled.
Can CVE-2008-6985 be exploited remotely?
Yes, remote attackers can exploit CVE-2008-6985 to execute arbitrary SQL commands through manipulation of the id parameter.
What are SQL injection vulnerabilities like CVE-2008-6985?
SQL injection vulnerabilities, like CVE-2008-6985, allow attackers to interfere with the queries that an application makes to its database.