CVEvulnerability
CVE-2006-2053
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2006-04-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Description
Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm. NOTE: these issues can also be exploited for path disclosure.
Affected configurations
• quickestore quickestore 7.9
References
- http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html pridels0.blogspot.com
- http://secunia.com/advisories/19817 secunia.com
- http://www.osvdb.org/24976 www.osvdb.org
- http://www.osvdb.org/24977 www.osvdb.org
- http://www.osvdb.org/24978 www.osvdb.org
- http://www.osvdb.org/24979 www.osvdb.org
- http://www.osvdb.org/24980 www.osvdb.org
- http://www.vupen.com/english/advisories/2006/1514 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26045 exchange.xforce.ibmcloud.com
- http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html pridels0.blogspot.com
- http://secunia.com/advisories/19817 secunia.com
- http://www.osvdb.org/24976 www.osvdb.org
- http://www.osvdb.org/24977 www.osvdb.org
- http://www.osvdb.org/24978 www.osvdb.org
- http://www.osvdb.org/24979 www.osvdb.org
- http://www.osvdb.org/24980 www.osvdb.org
- http://www.vupen.com/english/advisories/2006/1514 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26045 exchange.xforce.ibmcloud.com