CVE-2006-5957

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.19%

Published

Nov 17, 2006

Modified

Jun 16, 2026

Public PoC / Exploit (4)

All weaponized →

TrickestTrickest PoC index Exploit-DBINFINICART - 'added_to_cart.asp?ProductID' SQL Injection Exploit-DBINFINICART - 'browsesubcat.asp' Multiple SQL Injections Exploit-DBINFINICART - 'browse_group.asp?groupid' SQL Injection

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.

Weaknesses (CWE)

CWE-89

Affected Products (1)

infinicart · infinicartvulnerable

References (12)

http://secunia.com/advisories/22865

Vendor Advisory

http://securityreason.com/securityalert/1881

http://www.attrition.org/pipermail/vim/2006-December/001162.html

http://www.securityfocus.com/archive/1/451322/100/0/threaded

http://www.securityfocus.com/bid/21043

http://www.vupen.com/english/advisories/2006/4501