CVE-2015-9226

High

Published: 11/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators and authenticated users to execute arbitrary SQL commands through specific parameters in download and order update functions.

Risk Assessment

These vulnerabilities could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of organizational data.

Recommendation

It is recommended to upgrade to the latest version of AlegroCart and implement additional security measures such as input validation and sanitization.

Other vulnerabilities in AlegroCart 1.2.8

CVE-2015-9227High
CVE-2015-9227 in AlegroCart 1.2.8 has a remote file inclusion vulnerability in the get_file function, allowing remote administrators to execute arbitrary PHP code via a URL in the file_path parameter.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1) check_download and possibly (2) check_filename function in upload/admin2/model/products/model_admin_download.php or remote authenticated users with a valid Paypal transaction token to execute arbitrary SQL commands via the ref parameter in the (3) orderUpdate function in upload/catalog/extension/payment/paypal.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS