CVE-2006-5962

Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields in the (a) login screen, and (3) searchstring parameter in (b) insearch_list.asp.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/22904	Vendor Advisory
http://securityreason.com/securityalert/1879
http://www.vupen.com/english/advisories/2006/4535
https://exchange.xforce.ibmcloud.com/vulnerabilities/30288
https://exchange.xforce.ibmcloud.com/vulnerabilities/30287
https://www.exploit-db.com/exploits/2782
http://www.securityfocus.com/archive/1/451595/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:hpecs_shopping_cart:hpecs_shopping_cart:*:*:*:*:*:*:*:*

Information

Published : 2006-11-16 17:07

Updated : 2018-10-17 14:46

NVD link : CVE-2006-5962

Mitre link : CVE-2006-5962

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

hpecs_shopping_cart

hpecs_shopping_cart

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/22904", "name": "22904", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/1879", "name": "1879", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/4535", "name": "ADV-2006-4535", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30288", "name": "hpecs-searchlist-sql-injection(30288)", "tags": [], "refsource": "XF"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30287", "name": "hpecs-adminlogin-sql-injection(30287)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/2782", "name": "2782", "tags": [], "refsource": "EXPLOIT-DB"}, {"url": "http://www.securityfocus.com/archive/1/451595/100/0/threaded", "name": "20061114 hpecs shopping cart[login bypass & injection sql (post)]", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields in the (a) login screen, and (3) searchstring parameter in (b) insearch_list.asp."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-5962", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-11-17T01:07Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:hpecs_shopping_cart:hpecs_shopping_cart:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:46Z"}