Vulnerabilities > CVE-2013-1465 - Deserialization of Untrusted Data vulnerability in Cubecart

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
cubecart
CWE-502
critical
exploit available
NVD
Published: 2013-02-08
Updated: 2024-11-21

Summary

The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.

Vulnerable Configurations

Part Description Count
Application
Cubecart
19

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionCubeCart 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability. CVE-2013-1465. Webapps exploit for php platform
fileexploits/php/webapps/24465.txt
idEDB-ID:24465
last seen2016-02-02
modified2013-02-07
platformphp
port
published2013-02-07
reporterEgiX
sourcehttps://www.exploit-db.com/download/24465/
titleCubeCart 5.2.0 cubecart.class.php PHP Object Injection Vulnerability
typewebapps

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/120094/KIS-2013-02.txt
idPACKETSTORM:120094
last seen2016-12-05
published2013-02-06
reporterEgiX
sourcehttps://packetstormsecurity.com/files/120094/CubeCart-5.2.0-PHP-Object-Injection.html
titleCubeCart 5.2.0 PHP Object Injection

Seebug

bulletinFamilyexploit
descriptionNo description provided by source.
idSSV:78187
last seen2017-11-19
modified2014-07-01
published2014-07-01
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-78187
titleCubeCart 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability

References