Lucene search

[email protected]CVE-2006-6209

HistoryDec 01, 2006 - 1:28 a.m.

CVE-2006-6209

2006-12-0101:28:00

[email protected]

web.nvd.nist.gov

sql injection

midicart asp

shopping cart

asp plus

remote attackers

arbitrary commands

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

Low

0.037 Low

EPSS

Percentile

91.8%

JSON

Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) id2006quant parameter to (a) item_show.asp, or the (2) maingroup or (3) secondgroup parameter to (b) item_list.asp. NOTE: the code_no parameter to Item_Show.asp is covered by CVE-2005-2601.

Affected configurations

NVD

Node

midicart_softwaremidicart_asp_plus_shopping_cart

midicart_softwaremidicart_asp_shopping_cart

CPENameOperatorVersion
midicart_software:midicart_asp_plus_shopping_cartmidicart software midicart asp plus shopping carteq*
midicart_software:midicart_asp_shopping_cartmidicart software midicart asp shopping carteq*

CPE	Name	Operator	Version
midicart_software:midicart_asp_plus_shopping_cart	midicart software midicart asp plus shopping cart	eq	*
midicart_software:midicart_asp_shopping_cart	midicart software midicart asp shopping cart	eq	*

References

securityreason.com/securityalert/1947

www.aria-security.com/forum/showthread.php?t=42

www.securityfocus.com/archive/1/452557/100/0/threaded

www.securityfocus.com/archive/1/452573/100/0/threaded

www.securityfocus.com/bid/21273

exchange.xforce.ibmcloud.com/vulnerabilities/30506

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

Low

0.037 Low

EPSS

Percentile

91.8%

JSON

Related for CVE-2006-6209

nvd2 cvelist2 cve1