CVE-2006-5991 - Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute

CVE-2006-5991

Summary

Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp.

References

http://aria-security.net/advisory/WWWeb%20Cocepts.txt
http://secunia.com/advisories/22895
http://securityreason.com/securityalert/1887
http://www.securityfocus.com/archive/1/451513/100/100/threaded
http://www.securityfocus.com/bid/21076
http://www.vupen.com/english/advisories/2006/4528
https://exchange.xforce.ibmcloud.com/vulnerabilities/30261

Vulnerable Configurations

cpe:2.3:a:cactusoft:cactushop:*:*:*:*:*:*:*:*
cpe:2.3:a:cactusoft:cactushop:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 17-10-2018 - 21:46)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	21076
bugtraq	20061113 WWWeb Cocepts SQL Injection
misc	http://aria-security.net/advisory/WWWeb%20Cocepts.txt
secunia	22895
sreason	1887
vupen	ADV-2006-4528
xf	wwweb-prodtype-product-sql-injection(30261)

Last major update

17-10-2018 - 21:46

Published

21-11-2006 - 02:07

Last modified

17-10-2018 - 21:46