CVE-2015-2183

High

Published: 10/03/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in disporders detail, subadminmgt edit actions, or the cid parameter in an editcurrency action.

Risk Assessment

An attacker could gain access to sensitive data or modify the database, potentially leading to serious security implications for the organization.

Recommendation

It is recommended to update to the latest version of ZeusCart and implement input filtering and validation to minimize the risk of SQL injection attacks.

Other vulnerabilities in ZeusCart 4

CVE-2018-25435Medium
ZeusCart 4.0 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of victims, such as deactivating customer accounts via the regstatus endpoint with action=deny parameters.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/.