PT-2005-3357 · Unknown · Productcart

Zinho · Published 2005-08-03 · Updated 2017-07-11 · CVE-2005-2445

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Product Cart version 2.6

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the idcategory parameter in the "viewPrd.asp" file.

Recommendations For version 2.6, avoid using the idcategory parameter in the vulnerable "viewPrd.asp" file until the issue is resolved. As a temporary workaround, consider restricting access to the "viewPrd.asp" file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-2445

Affected Products

Productcart

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-2445 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21672 · Note
• http://osvdb.org/17329 · Note
• http://osvdb.org/18508 · Note
• http://securityfocus.com/bid/13881 · Note
• http://marc.info/?l=bugtraq&m=112274710020521&w=2 · Note
• http://securitytracker.com/id?1014129 · Note
• http://secunia.com/advisories/14833 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20956 · Note