PT-2006-6681 · Sitesoutlet · Sitesoutlet E-Commerce Kit-1 Paypal Edition

Benjamin Moss + 1 · Publicado 2006-11-21 · Atualizado 2018-10-17 · CVE-2006-6034

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SitesOutlet E-commerce Kit-1 PayPal Edition (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be exploited through specific parameters in certain files, including the keyword or cid parameter in "catalogue.asp", and the pid parameter in "viewDetail.asp".

Recommendations For SitesOutlet E-commerce Kit-1 PayPal Edition, consider restricting access to the catalogue.asp and viewDetail.asp files until a patch is available. As a temporary workaround, avoid using the keyword, cid, and pid parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-6034

Produtos afetados

Sitesoutlet E-Commerce Kit-1 Paypal Edition

Referências · 6

• http://securityfocus.com/archive/1/451771/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6034 · Nota de Segurança
• http://secunia.com/advisories/22975 · Aviso do Fabricante
• http://securityreason.com/securityalert/1900 · Nota
• http://vupen.com/english/advisories/2006/4571 · Nota
• http://securityfocus.com/bid/21056 · Nota