PT-2006-3143 · Avactis · Avactis Shopping Cart

Published 2006-05-04 · Updated 2017-07-20 · CVE-2006-2164

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avactis Shopping Cart versions 0.1.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands, which can lead to full path disclosure from invalid SQL queries. This is achieved via the category id parameter in "store special offers.php" and "store.php", and the prod id parameter in "cart.php" and "product info.php".

Recommendations For Avactis Shopping Cart versions 0.1.2 and earlier, consider restricting access to the store special offers.php, store.php, cart.php, and product info.php files until a patch is available. As a temporary workaround, avoid using the category id and prod id parameters in the affected files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-2164

Affected Products

Avactis Shopping Cart

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-2164 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26178 · Note
• http://pridels0.blogspot.com/2006/05/avactis-shopping-cart-vuln.html · Note
• http://osvdb.org/25639 · Note
• http://osvdb.org/25637 · Note
• http://osvdb.org/25638 · Note
• http://osvdb.org/25640 · Note