CVE-2015-9226: Alegrocart

High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1) check_download and possibly (2) check_filename function in upload/admin2/model/products/model_admin_download.php or remote authenticated users with a valid Paypal transaction token to execute arbitrary SQL commands via the ref parameter in the (3) orderUpdate function in upload/catalog/extension/payment/paypal.php.

Affected products

• Alegrocart Alegrocart: version 1.2.8 only

Published 2017-09-11. Last modified 2026-06-17.