CVEvulnerability
CVE-2008-0546
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-02-01
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idProduct and (2) options parameters to (a) ajax/ajax_optInventory.asp, or the (2) recid parameter to (b) ajax/ajax_getBrands.asp.
Affected configurations
• shoppingtree candypress store 4.1
• shoppingtree candypress store 4.1.1.26
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://secunia.com/advisories/28662 Vendor Advisory
- http://securityreason.com/securityalert/3600 securityreason.com
- http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1 Exploit
- http://www.securityfocus.com/archive/1/487058/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27454 Exploit
- http://www.vupen.com/english/advisories/2008/0314 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39939 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/4988 www.exploit-db.com
- http://secunia.com/advisories/28662 Vendor Advisory
- http://securityreason.com/securityalert/3600 securityreason.com
- http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1 Exploit
- http://www.securityfocus.com/archive/1/487058/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27454 Exploit
- http://www.vupen.com/english/advisories/2008/0314 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39939 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/4988 www.exploit-db.com