QwikSec

Security Database

CVE

CWE

Training

CVE-2015-8356

Published: Apr 14, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) xls_profile parameter to admin/mcart_xls_import.php or the (2) xls_iblock_id, (3) xls_iblock_section_id, (4) firstRow, (5) titleRow, (6) firstColumn, (7) highestColumn, (8) sku_iblock_id, or (9) xls_iblock_section_id_new parameter to admin/mcart_xls_import_step_2.php.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://packetstormsecurity.com/files/135258/Bitrix-mcart.xls-6.5.2-SQL-Injection.html

x_refsource_MISC

vdb-entry

x_refsource_BID

20160113 Multiple SQL Injection Vulnerabilities in mcart.xls Bitrix Module

mailing-list

x_refsource_BUGTRAQ

https://www.htbridge.com/advisory/HTB23279

x_refsource_MISC

exploit

x_refsource_EXPLOIT-DB

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.