PHPShop has multiple Security Vulnerabilities

Affected Systems:

PhpShop 0.6.1-B

Detailed description:

PhpShop is a PHP-based e-commerce program that can easily expand WEB functions. PhpShop has multiple security issues. Remote attackers can exploit these vulnerabilities to attack the database, obtain sensitive information, and execute arbitrary script code.

The specific problems are as follows:

1. SQL injection vulnerability:

When updating a session, there is an SQL injection problem. You can submit malicious SQL commands to the "page" variable to modify the original SQL logic, the same problem also exists when injecting the "product_id" and "offset" variables.

2. User Information Leakage vulnerability:

You can obtain a large amount of customer information by querying the "account/shipto" module. If you log on with a valid account, you may also view the Administrator information. This information includes the customer's address, company name, and so on.

3. Cross-site scripting attacks:

Multiple parameters do not fully filter the URI parameters submitted by users. submitting data containing malicious HTML code can trigger cross-site scripting attacks and obtain sensitive information of target users.

Currently, the vendor has not provided patches or upgrade programs.