CVE-2008-6986: SQL Injection
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct action, a different vulnerability than CVE-2008-6985.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6986?
CVE-2008-6986 is classified as a medium severity vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2008-6986?
To remediate CVE-2008-6986, upgrade Zen Cart to version 1.3.9 or later, which resolves the SQL injection vulnerability.
What versions of Zen Cart are affected by CVE-2008-6986?
CVE-2008-6986 affects Zen Cart versions 1.3.0 through 1.3.8a when magic_quotes_gpc is disabled.
Can CVE-2008-6986 be exploited remotely?
Yes, CVE-2008-6986 allows remote attackers to exploit the vulnerability if proper measures are not taken.
What is SQL injection in the context of CVE-2008-6986?
In CVE-2008-6986, SQL injection refers to an attack technique where an attacker injects malicious SQL commands into the 'products_id' parameter, leading to unauthorized database access.