PT-2006-2700 · Shopweezle · Shopweezle

Publicado 2006-04-11 · Atualizado 2017-07-20 · CVE-2006-1706

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Shopweezle version 2.0

Description: The issue allows remote attackers to execute arbitrary SQL commands, which can lead to full path disclosure from invalid SQL queries. This is achieved through SQL injection vulnerabilities in several parameters, including the itemID parameter to "login.php" and "memo.php", and the itemgr, brandID, and album parameters to "index.php".

Recommendations: For Shopweezle version 2.0, consider disabling the login.php, memo.php, and index.php scripts until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to these scripts to minimize the risk of path disclosure. Avoid using the itemID, itemgr, brandID, and album parameters in the affected scripts until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1706

Produtos afetados

Shopweezle

Referências · 14

• 🔥 https://exploit-db.com/exploits/27614 · Exploit
• 🔥 https://exploit-db.com/exploits/27612 · Exploit
• 🔥 http://securityfocus.com/bid/17441 · Exploit
• 🔥 https://exploit-db.com/exploits/27613 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25724 · Nota
• http://osvdb.org/24470 · Nota
• http://osvdb.org/24473 · Nota
• http://pridels0.blogspot.com/2006/04/shopweezle-20-multiple-vuln.html · Nota
• http://vupen.com/english/advisories/2006/1291 · Nota
• http://osvdb.org/24471 · Nota
• http://secunia.com/advisories/19593 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-1706 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25723 · Nota
• http://osvdb.org/24472 · Nota