CVE-2013-1465

The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.

Date published : 2013-02-08

http://www.securityfocus.com/bid/57770

http://archives.neohapsis.com/archives/bugtraq/2013-02/0032.html