Unscored severity · published Jun 10, 2010
CVE-2010-1931
SQL injection vulnerability in includes/content/cart.inc.php in CubeCart PHP Shopping cart 4.3.4 through 4.3.9 allows remote attackers to execute arbitrary SQL commands via the…
–
CVSS
1.3%
EPSS
No
On KEV
Description
SQL injection vulnerability in includes/content/cart.inc.php in CubeCart PHP Shopping cart 4.3.4 through 4.3.9 allows remote attackers to execute arbitrary SQL commands via the shipKey parameter to index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cubecart · Cubecart
4.3.4; 4.3.5; 4.3.6; 4.3.7; 4.3.8; 4.3.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1931
Patch
http://forums.cubecart.com/index.php?showtopic=41469
Exploit
http://osvdb.org/65250
Vendor Advisory
http://secunia.com/advisories/40102
Exploit
http://www.coresecurity.com/content/cubecart-php-shopping-cart-sql-injection
www.securityfocus.com
http://www.securityfocus.com/archive/1/511735/100/0/threaded
Exploit
http://www.securityfocus.com/bid/40641
More from Cubecart
9.8
CVE-2026-34018
An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product
9.8
CVE-2024-34832
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters
9.8
CVE-2018-20716
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature
9.8
CVE-2013-1465
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping…
8.1
CVE-2023-38130
Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system