The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
A backdoor password in Cart32 3.0 and earlier allows remote attackers to execute arbitrary commands.