SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the glob[rootDir] parameter.

Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via (1) the username parameter in admin/forgotpass.php, (2) the orderid parameter in vieworder.php, (3) the viewdoc parameter in viewdoc.php, and (4) the orderid parameter in admin/printorder.php.

Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) xinvoicenum parameter in modules/gateway/Authorize/confirmed.php.

SQL injection vulnerability in includes/content/viewCat.inc.php in CubeCart 3.0.12 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the searchArray[] parameter.

Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie modification.

Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the orderid parameter in (1) admin/printorder.php and (2) vieworder.php; the (3) siteurl and (4) lasearchhome parameters and (5) certain language parameters in admin/nav.php; the (6) image parameter in admin/image.php; the (7) sitename, (8) laadmheader, (9) charset, and (10) certain other parameters in admin/header.inc.php; the (12) lapowby parameter in footer.inc.php; and the (13) sitename parameter and (14) certain other parameters in header.inc.php.

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a) admin/filemanager/preview.php; and the (4) email parameter in (b) admin/login.php.

CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2) language.php, (3) listdocs.php, (4) popularprod.php, (5) sale.php, (6) subfooter.inc.php, (7) subheader.inc.php, (8) catnavi.php, or (9) checksum.php, which reveals the path in a PHP error message.

Directory traversal vulnerability in index.php for CubeCart 2.0.4 allows remote attackers to read arbitrary files via the language parameter.

CubeCart 2.0.6 allows remote attackers to obtain sensitive information via an invalid (1) language parameter to index.php, (2) PHPSESSID parameter to index.php, (3) product parameter to tellafriend.php, (4) add parameter to viewcart.php, or (5) product parameter to viewproduct.php, which reveals the path in a PHP error message.

index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid catid parameter, which reveals the full path in a PHP error message.

Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) linknavi.php or (2) spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, listdocs.php, popularprod.php, sale.php, checksum.php, and catnavi.php vectors are already covered by CVE-2005-0607.

CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.

Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to (1) cart.php or (2) index.php.

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php, or (3) the searchStr parameter in a viewCat action to index.php. Note: vectors (1) and (2) were later reported to affect 3.0.7-pl1.

Cross-site scripting (XSS) vulnerability in settings.inc.php for CubeCart 2.0.0 through 2.0.5, as used in multiple PHP files, allows remote attackers to inject arbitrary HTML or web script via the (1) catid, (2) PHPSESSID, (3) viewdoc, (4) product, (5) session, (6) catname, (7) search, or (8) page parameters.

index.php in CubeCart 2.0.4 allows remote attackers to (1) obtain the full path for the web server or (2) conduct cross-site scripting (XSS) attacks via an invalid language parameter, which echoes the parameter in a PHP error message.

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.

Cross-site scripting (XSS) vulnerability in CubeCart 3.0.12 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array.

includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magicquotesgpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allows remote attackers to conduct PHP remote file inclusion attacks.