EDB-34062

PoC

Shopizer 1.1.5 - Multiple Vulnerabilities

view exploit source exploit_dbtype webappsauthor SEC Consultpublished 2014-07-14catalog exploit_db

exploited CVEs (4)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2014-4965US	medium4.3	3.25% (88th)	Exploit	2014-07-15
Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter t…
CVE-2014-4964US	medium6.8	2.30% (83rd)	Exploit	2014-07-15
Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that (1) modify c…
CVE-2014-4963US	medium6.8	3.74% (90th)	Exploit	2014-07-15
Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action.
CVE-2014-4962US	medium6.4	4.71% (92nd)	Exploit	2014-07-15
Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuantity parameter, which causes the price of…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.