php multivendor ecommerce vulnerabilities and fixes

Recent CVEs affecting php multivendor ecommerce, with upgrade or downgrade steps. 11 tracked.

Also searched as: phpmultivendorecommerce.

php multivendor ecommerce has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-12-28. Highest priority: CVE-2017-17624 (score 66/100).

• CVE-2017-17960 HIGH 8.8 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
• CVE-2017-17959 CRITICAL 9.8 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.
• CVE-2017-17958 MEDIUM 6.1 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
• CVE-2017-17957 CRITICAL 9.8 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.
• CVE-2017-17956 MEDIUM 6.1 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
• CVE-2017-17955 MEDIUM 6.1 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
• CVE-2017-17954 MEDIUM 6.1 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
• CVE-2017-17953 MEDIUM 6.1 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
• CVE-2017-17952 HIGH 8.6 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote
• CVE-2017-17951 CRITICAL 9.8 MITIGATE PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.
• CVE-2017-17624 CRITICAL 9.8 DOWNGRADE PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php s

FAQ

How do I fix php multivendor ecommerce vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is php multivendor ecommerce being exploited right now?

None of the tracked php multivendor ecommerce CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which php multivendor ecommerce CVE should I patch first?

CVE-2017-17624 currently ranks highest (66/100): PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php s.

RSS feed for php multivendor ecommerce · ← Back to latest CVEs