A backdoor password in Cart32 3.0 and earlier allows remote attackers to execute arbitrary commands.
The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.