It has come to my attention that a hacker could use a blind SQL injection in order to cause problems on a website running CFShopkart
When viewing categories in the shopping cart the hacker could append something to the URL variable category=1 to cause problems on your site.
I will have a fix for this along with some other updates in the next release, but here is a simple fix to the potential security risk:
Open the following files:
At or near the top make sure you have the following line:
cfparam name = "category" default="0" type="integer"
If the lins is there make sure you add type integer. This is a quick and simple fix, and should prevent this type of attack. From my understanding, those using the MS Access DB are particularly vulnerable to this type of attack.