CVE-2006-5957
- State
- Published
- Severity
- Not scored
- Published
- Nov 17, 2006
- Updated
- Aug 7, 2024
- Reserved
- Nov 16, 2006
Description
Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 21043vdb-entry
- 20061112 infinicart [ multiples injection sql & xss (post) ]mailing-list
- ADV-2006-4501vdb-entry
- 22865third-party-advisory
- 20061206 Vendor dispute: infinicart (CVE-2006-5957)mailing-list
- 1881third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.