PT-2006-6839 · Midicart · Midicart Asp Plus Shopping Cart

Publicado 2006-12-01 · Atualizado 2018-10-17 · CVE-2006-6209

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MidiCart ASP Shopping Cart (affected versions not specified) MidiCart ASP Plus Shopping Cart (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id2006quant parameter to the "item show.asp" endpoint, or the maingroup or secondgroup parameter to the "item list.asp" endpoint.

Recommendations For MidiCart ASP Shopping Cart, restrict access to the item show.asp and item list.asp endpoints until a fix is available. For MidiCart ASP Plus Shopping Cart, avoid using the id2006quant, maingroup, and secondgroup parameters in the affected API endpoints until the issue is resolved. As a temporary workaround, consider disabling the SQL execution functionality in the vulnerable endpoints until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-6209

Produtos afetados

Midicart Asp Plus Shopping Cart

Referências · 8

• 🔥 https://exploit-db.com/exploits/29174 · Exploit
• 🔥 http://securityfocus.com/bid/21273 · Exploit
• 🔥 http://aria-security.com/forum/showthread.php?t=42 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30506 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6209 · Nota de Segurança
• http://securityfocus.com/archive/1/452557/100/0/threaded · Nota
• http://securityfocus.com/archive/1/452573/100/0/threaded · Nota
• http://securityreason.com/securityalert/1947 · Nota