PT-2006-1153 · Primo · Primo Cart

Published 2006-01-03 · Updated 2011-03-08 · CVE-2006-0068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Primo Cart versions 1.0 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the "q" parameter to the "search.php" endpoint and the "email" parameter to the "user.php" endpoint.

Recommendations: For Primo Cart versions 1.0 and earlier, consider restricting access to the "search.php" and "user.php" endpoints until a patch is available. As a temporary workaround, avoid using the q parameter in the "search.php" endpoint and the email parameter in the "user.php" endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0068

Affected Products

Primo Cart

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-0068 · Security Note
• http://secunia.com/advisories/18264 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0008 · Note
• http://securityfocus.com/bid/16125 · Note
• http://osvdb.org/22146 · Note
• http://pridels0.blogspot.com/2006/01/primo-cart-sql-inj.html · Note
• http://osvdb.org/22147 · Note