CVE-2015-8356: Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote au...

Security readout for executives and security teams

CVE-2015-8356 is a set of SQL injection flaws in the Bitrix mcart.xls module 6.5.2 and earlier. An authenticated remote user could manipulate import-related admin parameters to run arbitrary database queries, putting site data and integrity at risk. Exposure is likely limited to Bitrix deployments using mcart.xls version 6.5.2 or earlier where authenticated users can access the module's admin import functionality. Prioritize review for any internet-facing Bitrix site using this module. The issue needs attention because authenticated access could become database-level compromise, but urgency depends on whether the module is present and reachable. Mitigation focus: Identify whether mcart.xls is installed and business-required.; Check Bitrix or module vendor guidance for a fixed version or official remediation.; Restrict access to the affected admin import functionality to trusted administrators..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.