Vulnerabilidades

Vulnerabilidad de inyección SQL en admin.php en TurnkeyForms Text Link Sales permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "id".

Vulnerabilidad de Inyección SQL del componente com_salesrep de Joomla! and Mambo, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro rid en una acción showrep en el index.php

EZPhotoSales 1.9.3 y anteriores tiene una cuenta "admin" por defecto para las galerías, lo cual permite a atacantes remotos acceder a galerías de su elección especificando este nombre de usuario.

EZPhotoSales 1.9.3 y versiones anteriores permite a atacantes remotos descargar ficheros de imagen mediante (1) una petición directa de un URL bajo OnlineViewing/galleries/ ó (2) navegación del interfaz de usuario de galería con JavaScript deshabilitado.

Vulnerabilidad de envío de archivo no restringido en EZPhotoSales 1.9.3 y anteriores permite a administradores autenticados remotamente enviar y ejecutar código PHP de su elección bajo OnlineViewing/galleries/.

EZPhotoSales 1.9.3 y versiones anteriores almacena información confidencial bajo el raíz del web con control de acceso insuficiente, lo cual permite a atacantes remotos descargar (1) un fichero conteniendo contraseñas en texto en claro mediante una petición directa de OnlineViewing/data/galleries.txt, ó (2) un fichero…

** EN DISPUTA ** Múltiples vulnerabilidades de inyección SQL en cgi-bin/reorder2.asp en SalesCart Shopping Cart permite a atacantes remotos ejecutar comandos SQL arbitrarios mediante un campo contraseña y otros vectores no especificados. NOTA: El vendedor ha impugnado esta vulnerabilidad argumentando que "Podemos…

The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default.

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other…

SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring.

Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data.

SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.

slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter, which reveals the path in an error message.

SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain access.

slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive information in the ErrorLogMsg cookie.

SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port…

Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request.

SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation.

SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.

SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.

MidiCart almacena el fichero de base de datos midicart.mdb bajo la raíz de documentos web, lo que permite a atacantes remotos robar información sensible pidiendo la base de datos directamente.

The SalesLogix Eviewer allows remote attackers to cause a denial of service by accessing the URL for the slxweb.dll administration program, which does not authenticate the user.

The SalesCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.

.sbstart startup script in AcuShop Salesbuilder is world writable, which allows local users to gain privileges by appending commands to the file.