PT-2006-5106 · Oscommerce · Oscommerce

Publicado 2006-08-23 · Atualizado 2018-10-17 · CVE-2006-4297

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCommerce versions prior to 2.2 Milestone 2 060817

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id array parameters in the shopping cart.php file.

Recommendations For versions prior to 2.2 Milestone 2 060817, update to version 2.2 Milestone 2 060817 or later to resolve the issue. As a temporary workaround, consider restricting access to the shopping cart.php file or validating and sanitizing the id array parameters to prevent SQL injection attacks.

Exploit

Correção

Identificadores relacionados

CVE-2006-4297

Produtos afetados

Oscommerce

Referências · 9

• 🔥 http://gulftech.org/?node=research&article_id=00110-08172006 · Exploit
• http://securitytracker.com/id?1016719 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-4297 · Nota de Segurança
• http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371 · Nota
• http://securityfocus.com/bid/19774 · Nota
• http://securityfocus.com/bid/19644 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28434 · Nota
• http://securityfocus.com/archive/1/444780/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4297 · Nota