Unscored severity · published Oct 8, 2011
CVE-2010-4903
SQL injection vulnerability in index.php in CubeCart 4.3.3 allows remote attackers to execute arbitrary SQL commands via the searchStr parameter
–
CVSS
1.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in index.php in CubeCart 4.3.3 allows remote attackers to execute arbitrary SQL commands via the searchStr parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cubecart · Cubecart
4.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4903
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4903
Vendor Advisory
http://secunia.com/advisories/41352
securityreason.com
http://securityreason.com/securityalert/8441
www.acunetix.com
http://www.acunetix.com/blog/web-security-zone/articles/sql-injection-xss-cubecart-4-3-3/
www.securityfocus.com
http://www.securityfocus.com/archive/1/513572/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/43114
More from Cubecart
9.8
CVE-2026-34018
An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product
9.8
CVE-2024-34832
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters
9.8
CVE-2018-20716
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature
9.8
CVE-2013-1465
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping…
8.1
CVE-2023-38130
Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system