PT-2006-5845 · Cubecart · Cubecart

Hackers Pal · Published 2006-10-02 · Updated 2018-10-17 · CVE-2006-5107

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CubeCart versions 2.0.x

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through several parameters in different files, including the user name parameter in "admin/forgot pass.php", the order id parameter in "view order.php" and "admin/print order.php", and the view doc parameter in "view doc.php".

Recommendations For CubeCart version 2.0.x, update to a version that includes a fix for the SQL injection vulnerabilities. As a temporary workaround, consider restricting access to the affected files, specifically "admin/forgot pass.php", "view order.php", "view doc.php", and "admin/print order.php", to minimize the risk of exploitation. Avoid using the user name, order id, and view doc parameters in the respective affected files until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5107

Affected Products

Cubecart

References · 10

• 🔥 http://securityfocus.com/bid/20215 · Exploit
• 🔥 https://exploit-db.com/exploits/28695 · Exploit
• 🔥 https://exploit-db.com/exploits/28698 · Exploit
• 🔥 https://exploit-db.com/exploits/28697 · Exploit
• 🔥 https://exploit-db.com/exploits/28696 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5107 · Security Note
• http://securityreason.com/securityalert/1662 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29176 · Note
• http://securityfocus.com/archive/1/447009/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5107 · Note