cpe:/a:zen-cart:zen_cart:1.3 cpe:/a:zen-cart:zen_cart:1.3.0.2 cpe:/a:zen-cart:zen_cart:1.3.2 cpe:/a:zen-cart:zen_cart:1.3.5 cpe:/a:zen-cart:zen_cart:1.3.6 cpe:/a:zen-cart:zen_cart:1.3.7 cpe:/a:zen-cart:zen_cart:1.3.8 cpe:/a:zen-cart:zen_cart:1.3.8a CVE-2008-6986 2009-08-19T01:24:52.467-04:00 2009-08-19T00:00:00.000-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2009-08-19T09:42:00.000-04:00 BUGTRAQ 20080904 Re: Zen Cart <= 1.3.8a SQL Injection BUGTRAQ 20080904 Zen Cart <= 1.3.8a SQL Injection BID 31023 SECUNIA 31758 OSVDB 48347 MISC http://www.gulftech.org/?node=research&article_id=00129-09042008 CONFIRM http://www.zen-cart.com/forum/showthread.php?p=604473 SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.