CVE-2008-6986 | SynScan

Vulnerability Database

289,784

Total vulnerabilities in the database

CVE-2008-6986

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.

Published: Aug 19, 2009
Updated: Apr 13, 2023
CVE: CVE-2008-6986
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
zen-cart / zen_cart	1.3.8a	1.3.8a.x
zen-cart / zen_cart	1.3.2	1.3.2.x
zen-cart / zen_cart	1.3.0.2	1.3.0.2.x
zen-cart / zen_cart	1.3.6	1.3.6.x
zen-cart / zen_cart	1.3.7	1.3.7.x
zen-cart / zen_cart	1.3.8	1.3.8.x
zen-cart / zen_cart	1.3	1.3.x
zen-cart / zen_cart	1.3.5	1.3.5.x