PT-2006-6681 · Sitesoutlet · Sitesoutlet E-Commerce Kit-1 Paypal Edition

Benjamin Moss + 1 · Published 2006-11-21 · Updated 2018-10-17 · CVE-2006-6034

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SitesOutlet E-commerce Kit-1 PayPal Edition (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be exploited through specific parameters in certain files, including the keyword or cid parameter in "catalogue.asp", and the pid parameter in "viewDetail.asp".

Recommendations For SitesOutlet E-commerce Kit-1 PayPal Edition, consider restricting access to the catalogue.asp and viewDetail.asp files until a patch is available. As a temporary workaround, avoid using the keyword, cid, and pid parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-6034

Affected Products

Sitesoutlet E-Commerce Kit-1 Paypal Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-6034 · Security Note
• http://secunia.com/advisories/22975 · Vendor Advisory
• http://securityfocus.com/archive/1/451771/100/0/threaded · Note
• http://securityreason.com/securityalert/1900 · Note
• http://vupen.com/english/advisories/2006/4571 · Note
• http://securityfocus.com/bid/21056 · Note