Description
SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the (1) admin_name or (2) admin_pass parameters.
References
- zencart-login-sql-injection(16176) vdb-entry
- 20060517 Re: Zen Cart login.php SQL Injection Vulnerability mailing-list
- 1010172 vdb-entry
- http://www.zen-cart.com/modules/ipb/index.php?showtopic=4835
- http://www.packetstormsecurity.org/0405-advisories/zencart112d.txt
- 10378 vdb-entry
- 6298 vdb-entry
- 20040518 Zen Cart login.php SQL Injection Vulnerability mailing-list
- 11649 third-party-advisory
- http://www.zen-cart.com/modules/mydownloads/viewcat.php?cid=31&orderby=dateD