CVE-2013-1465: Input Validation
The Cubecart::basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1465?
The severity of CVE-2013-1465 is considered high due to the potential for remote code execution through object injection.
How do I fix CVE-2013-1465?
To fix CVE-2013-1465, upgrade CubeCart to version 5.2.1 or later, where the vulnerability has been patched.
What versions of CubeCart are affected by CVE-2013-1465?
CVE-2013-1465 affects CubeCart versions from 5.0.0 to 5.2.0, inclusive.
What kind of attack can exploit CVE-2013-1465?
CVE-2013-1465 can be exploited through crafted shipping parameters to unserialize arbitrary PHP objects.
Is CVE-2013-1465 a remote vulnerability?
Yes, CVE-2013-1465 is a remote vulnerability that allows attackers to exploit the CubeCart application without physical access.