SQL Injection Vulnerability in C97net Cart Engine 4.0: Remote Code Execution via item_id Parameter

CVE-2014-8306 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the item_id variable, as demonstrated by the (1) item_id[0] or (2) item_id[] parameter.

Learn more about our Web Application Penetration Testing UK.