CVE-2008-6986

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.

• CWE-89

• http://secunia.com/advisories/31758Vendor Advisory
• http://www.gulftech.org/?node=research&article_id=00129-09042008Exploit
• http://www.osvdb.org/48347
• http://www.securityfocus.com/archive/1/496002/100/0/threaded
• http://www.securityfocus.com/archive/1/496032/100/100/threaded
• http://www.securityfocus.com/bid/31023
• http://www.zen-cart.com/forum/showthread.php?p=604473Vendor Advisory
• http://secunia.com/advisories/31758Vendor Advisory
• http://www.gulftech.org/?node=research&article_id=00129-09042008Exploit
• http://www.osvdb.org/48347
• http://www.securityfocus.com/archive/1/496002/100/0/threaded
• http://www.securityfocus.com/archive/1/496032/100/100/threaded
• http://www.securityfocus.com/bid/31023
• http://www.zen-cart.com/forum/showthread.php?p=604473Vendor Advisory

Published

Aug 19, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-6980SQL injection vulnerability in as_archives.php in phpAdultSi…
• CVE-2008-6981index.php in phpAdultSite CMS, possibly 2.3.2, allows remote…
• CVE-2008-6982Cross-site scripting (XSS) vulnerability in index.php in dev…
• CVE-2008-6983modules/tool/hitcounter.php in devalcms 1.4a allows remote a…
• CVE-2008-6984Plesk 8.6.0, when short mail login names (SHORTNAMES) are en…
• CVE-2008-6985Multiple SQL injection vulnerabilities in includes/classes/s…
• CVE-2008-6987Unrestricted file upload vulnerability in eZoneScripts Datin…
• CVE-2008-6988Multiple cross-site scripting (XSS) vulnerabilities in Easy …
• CVE-2008-6989SQL injection vulnerability in gallery.php in Easy Photo Gal…
• CVE-2008-6990SQL injection vulnerability in gallery.php in Easy Photo Gal…
• CVE-2008-6991SQL injection vulnerability in public/page.php in Websens CM…
• CVE-2008-6992GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.…