CVE-2006-2053 - Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to exec

CVE-2006-2053

Summary

Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm. NOTE: these issues can also be exploited for path disclosure.

References

Vulnerable Configurations

cpe:2.3:a:quickestore:quickestore:7.9:*:*:*:*:*:*:*
cpe:2.3:a:quickestore:quickestore:7.9:*:*:*:*:*:*:*

CVSS

Base:	6.4 (as of 20-07-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:N

refmap via4

misc	http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html
osvdb	24976 24977 24978 24979 24980
secunia	19817
vupen	ADV-2006-1514
xf	quickestore-multiple-sql-injection(26045)

Last major update

20-07-2017 - 01:31

Published

26-04-2006 - 20:06

Last modified

20-07-2017 - 01:31