CVE-2005-1398

Published: May 3, 2005Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

phpcart.php in PHPCart 3.2 allows remote attackers to change product price information by modifying the (1) price or (2) postage parameters. NOTE: it was later reported that 3.4 through 4.6.4 are also affected.

Affected (3)

Products: Phpcart: Phpcart

Phpcart

1 product

Phpcart

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Phpcart Phpcart	Version 3.2
Phpcart Phpcart	Version 3.4
Phpcart Phpcart	Version 4.6.4

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://lostmon.blogspot.com/2005/04/phpcart-price-manipulation.html

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/15147

Source: cve@mitre.org

Vendor Advisory

http://www.osvdb.org/15859

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/495806/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/13406

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/bid/30887

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/44766

Source: cve@mitre.org

http://lostmon.blogspot.com/2005/04/phpcart-price-manipulation.html