SQL Injection in Candypress Store
CVE-2006-6109
Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.
Vulnerability class: SQL Injection
EPSS: 0.014 (70.2th percentile) — read the EPSS interpretation.
Affected products
- Candypress Candypress_store — versions 3.5.2.14
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (Exploit, x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List)
- cve@mitre.org (vdb-entry, Not Applicable, x_refsource_VUPEN)
- cve@mitre.org (URL Repurposed, x_refsource_MISC, Broken Link)