SQL Injection in Iscripts Multicart

CVE-2007-5261

Multiple SQL injection vulnerabilities in MultiCart 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to categorydetail.php and the (2) ddlCategory parameter to search.php.

Vulnerability class: SQL Injection

EPSS: 0.020 (78.6th percentile) — read the EPSS interpretation.

Affected products

Iscripts Multicart — versions 1.0
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (vdb-entry, x_refsource_BID)