CVE-2005-4003

Multiple SQL injection vulnerabilities in Absolute Shopping Package Solutions (ASPS) Shopping Cart Professional 2.9d and earlier, and Lite 2.1 and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) srch_product_name parameter to adv_search.asp and (2) b_search parameter to bsearch.asp. NOTE: the original disclosure was specifically only for an XSS issue, but the CVE description was for SQL injection. Since the original disclosure, SQL injection vectors have been reported. This CVE might be REJECTed or significantly altered pending additional information.

• http://pridels0.blogspot.com/2005/12/asps-shopping-cart-professional-and.html
• http://www.securityfocus.com/bid/15694Exploit
• http://pridels0.blogspot.com/2005/12/asps-shopping-cart-professional-and.html
• http://www.securityfocus.com/bid/15694Exploit

Published

Dec 5, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3997Zen Cart 1.2.6d and earlier, under certain PHP configuration…
• CVE-2005-3998Cross-site scripting (XSS) vulnerability in search.asp in So…
• CVE-2005-3999Cross-site scripting (XSS) vulnerability in Search.asp in Si…
• CVE-2005-4000Cross-site scripting (XSS) vulnerability in archive.asp in S…
• CVE-2005-4001Multiple SQL injection vulnerabilities in phpYellowTM Pro Ed…
• CVE-2005-4002WebEOC before 6.0.2 uses the same secret key for all install…
• CVE-2005-4004Cross-site scripting (XSS) vulnerability in search.asp in My…
• CVE-2005-4005SQL injection vulnerability in messages.php in PHP-Fusion 6.…
• CVE-2005-4006SAPID CMS before 1.2.3.03 allows remote attackers to bypass …
• CVE-2005-4007Multiple unspecified vulnerabilities in SAPID CMS before 1.2…
• CVE-2005-4008SQL injection vulnerability in jax_calendar.php in Jax Calen…
• CVE-2005-4009Multiple SQL injection vulnerabilities in PHP Lite Calendar …