Multiple SQL injection vulnerabilities in (1) addcustomer.asp (2) addprod.asp and (3) process.asp in a.shopKart 2.0.3 allow remote attackers to execute arbitrary SQL and obtain sensitive information via the zip state country phone and fax parameters.