PT-2006-6839 · Midicart · Midicart Asp Plus Shopping Cart

Published 2006-12-01 · Updated 2018-10-17 · CVE-2006-6209

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MidiCart ASP Shopping Cart (affected versions not specified) MidiCart ASP Plus Shopping Cart (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id2006quant parameter to the "item show.asp" endpoint, or the maingroup or secondgroup parameter to the "item list.asp" endpoint.

Recommendations For MidiCart ASP Shopping Cart, restrict access to the item show.asp and item list.asp endpoints until a fix is available. For MidiCart ASP Plus Shopping Cart, avoid using the id2006quant, maingroup, and secondgroup parameters in the affected API endpoints until the issue is resolved. As a temporary workaround, consider disabling the SQL execution functionality in the vulnerable endpoints until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-6209

Affected Products

Midicart Asp Plus Shopping Cart

References · 8

• 🔥 https://exploit-db.com/exploits/29174 · Exploit
• 🔥 http://securityfocus.com/bid/21273 · Exploit
• 🔥 http://aria-security.com/forum/showthread.php?t=42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6209 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30506 · Note
• http://securityfocus.com/archive/1/452557/100/0/threaded · Note
• http://securityfocus.com/archive/1/452573/100/0/threaded · Note
• http://securityreason.com/securityalert/1947 · Note