CVE-2006-6207

SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securityreason.com/securityalert/1933
http://www.securityfocus.com/archive/1/452706/100/0/threaded
http://www.securityfocus.com/archive/1/453549/100/0/threaded
http://www.securityfocus.com/bid/21323	Exploit Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30540

Configurations

Configuration 1 (hide)

cpe:2.3:a:lynx_internet_solutions:evolve_merchant:*:*:*:*:*:*:*:*

History

07 Nov 2023, 01:59

Type	Values Removed	Values Added
Summary	DISPUTED SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error.	SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error

Information

Published : 2006-12-01 01:28

Updated : 2024-08-07 21:15

NVD link : CVE-2006-6207

Mitre link : CVE-2006-6207

CVE.ORG link : CVE-2006-6207

JSON object : View

Products Affected

lynx_internet_solutions

evolve_merchant

CWE

NVD-CWE-Other

{"id": "CVE-2006-6207", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-12-01T01:28:00.000", "references": [{"url": "http://securityreason.com/securityalert/1933", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/452706/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/453549/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21323", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30540", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error"}, {"lang": "es", "value": "** IMPUGNADA ** Vulnerabilidad de inyecci\u00f3n SQL en products.asp de Evolve shopping cart (tambi\u00e9n conocido como Evolve Merchant) permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro partno. NOTA: el vendedor impugna este asunto, indicando que es un error forzado de SQL."}], "lastModified": "2024-08-07T21:15:29.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lynx_internet_solutions:evolve_merchant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5047A46F-9BE6-4A8F-AB7B-9202E3251DFC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}