PT-2006-5106 · Oscommerce · Oscommerce

Published 2006-08-23 · Updated 2018-10-17 · CVE-2006-4297

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCommerce versions prior to 2.2 Milestone 2 060817

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id array parameters in the shopping cart.php file.

Recommendations For versions prior to 2.2 Milestone 2 060817, update to version 2.2 Milestone 2 060817 or later to resolve the issue. As a temporary workaround, consider restricting access to the shopping cart.php file or validating and sanitizing the id array parameters to prevent SQL injection attacks.

Exploit

Fix

Related Identifiers

CVE-2006-4297

Affected Products

Oscommerce

References · 9

• 🔥 http://gulftech.org/?node=research&article_id=00110-08172006 · Exploit
• http://securitytracker.com/id?1016719 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4297 · Security Note
• http://securityfocus.com/bid/19644 · Patch
• http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371 · Note
• http://securityfocus.com/bid/19774 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28434 · Note
• http://securityfocus.com/archive/1/444780/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4297 · Note