CVE-2008-6986
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes...
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
- Record
CVE-2008-6986- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
- Record
CVE-2008-6986- Updated
- 2026-11-02
EUVDEUVD-2008-6945 No score
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
- Record
EUVD-2008-6945- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wqg-8wg4-c3m7 No score
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes...
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
- Record
GHSA-4wqg-8wg4-c3m7- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-6986 is a medium vulnerability (CVSS 6.8) in Zen-cart Zen Cart, published August 18, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.81%, the 86th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/496002/100/0/threaded
osvdb.org/48347
zen-cart.com/forum/showthread.php?p=604473
secunia.com/advisories/31758
gulftech.org?node=research&article_id=00129-09042008
nvd.nist.gov/vuln/detail/CVE-2008-6986
github.com/advisories/GHSA-4wqg-8wg4-c3m7