Unscored severity · published Apr 26, 2006
CVE-2006-2053
Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm. NOTE: these issues can also be exploited for path disclosure.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quickestore · Quickestore
7.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2053
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2053
pridels0.blogspot.com
http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html
secunia.com
http://secunia.com/advisories/19817
www.osvdb.org
http://www.osvdb.org/24976
www.osvdb.org
http://www.osvdb.org/24977
www.osvdb.org
http://www.osvdb.org/24978
www.osvdb.org
http://www.osvdb.org/24979
More from Quickestore
–
CVE-2007-3933
SQL injection vulnerability in insertorder.cfm in QuickEStore 8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the CFTOKEN parameter, a different…