PT-2006-2700 · Shopweezle · Shopweezle

Published 2006-04-11 · Updated 2017-07-20 · CVE-2006-1706

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Shopweezle version 2.0

Description: The issue allows remote attackers to execute arbitrary SQL commands, which can lead to full path disclosure from invalid SQL queries. This is achieved through SQL injection vulnerabilities in several parameters, including the itemID parameter to "login.php" and "memo.php", and the itemgr, brandID, and album parameters to "index.php".

Recommendations: For Shopweezle version 2.0, consider disabling the login.php, memo.php, and index.php scripts until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to these scripts to minimize the risk of path disclosure. Avoid using the itemID, itemgr, brandID, and album parameters in the affected scripts until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-1706

Affected Products

Shopweezle

References · 14

• 🔥 https://exploit-db.com/exploits/27614 · Exploit
• 🔥 https://exploit-db.com/exploits/27612 · Exploit
• 🔥 http://securityfocus.com/bid/17441 · Exploit
• 🔥 https://exploit-db.com/exploits/27613 · Exploit
• http://secunia.com/advisories/19593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1706 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25724 · Note
• http://osvdb.org/24470 · Note
• http://osvdb.org/24473 · Note
• http://pridels0.blogspot.com/2006/04/shopweezle-20-multiple-vuln.html · Note
• http://vupen.com/english/advisories/2006/1291 · Note
• http://osvdb.org/24471 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25723 · Note
• http://osvdb.org/24472 · Note