CVE-2006-4297 - Vulnerability Details - OpenCVE

SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00963.

Key SSVC decision points have not yet been added.

Vendors	Products
Oscommerce	Oscommerce

Configuration 1 [-]

cpe:2.3:a:oscommerce:oscommerce:2.2_ms2_2006-08-17:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2006-4285	SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371
http://securitytracker.com/id?1016719
http://www.gulftech.org/?node=research&article_id=00110-08172006
http://www.securityfocus.com/archive/1/444780/100/0/threaded
http://www.securityfocus.com/bid/19644
http://www.securityfocus.com/bid/19774
https://exchange.xforce.ibmcloud.com/vulnerabilities/28434

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-08-23T01:00:00

Updated: 2024-08-07T19:06:06.754Z

Reserved: 2006-08-22T00:00:00

Link: CVE-2006-4297

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-08-23T01:04:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-4297

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-08-18T00:00:00", "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "oscommerce-shoppingcart-sql-injection(28434)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28434"}, {"name": "1016719", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1016719"}, {"name": "20060830 osCommerce < 2.2 Milestone 2 060817 POC Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/444780/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.gulftech.org/?node=research&article_id=00110-08172006"}, {"name": "19774", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/19774"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371"}, {"name": "19644", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/19644"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-4297", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "oscommerce-shoppingcart-sql-injection(28434)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28434"}, {"name": "1016719", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1016719"}, {"name": "20060830 osCommerce < 2.2 Milestone 2 060817 POC Exploit", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/444780/100/0/threaded"}, {"name": "http://www.gulftech.org/?node=research&article_id=00110-08172006", "refsource": "MISC", "url": "http://www.gulftech.org/?node=research&article_id=00110-08172006"}, {"name": "19774", "refsource": "BID", "url": "http://www.securityfocus.com/bid/19774"}, {"name": "http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371", "refsource": "CONFIRM", "url": "http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371"}, {"name": "19644", "refsource": "BID", "url": "http://www.securityfocus.com/bid/19644"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T19:06:06.754Z"}, "title": "CVE Program Container", "references": [{"name": "oscommerce-shoppingcart-sql-injection(28434)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28434"}, {"name": "1016719", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1016719"}, {"name": "20060830 osCommerce < 2.2 Milestone 2 060817 POC Exploit", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/444780/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.gulftech.org/?node=research&article_id=00110-08172006"}, {"name": "19774", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/19774"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371"}, {"name": "19644", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/19644"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-4297", "datePublished": "2006-08-23T01:00:00", "dateReserved": "2006-08-22T00:00:00", "dateUpdated": "2024-08-07T19:06:06.754Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oscommerce:oscommerce:2.2_ms2_2006-08-17:*:*:*:*:*:*:*", "matchCriteriaId": "EFC95B48-A7DF-49DF-B24C-3C8370D9FB53", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters."}, {"lang": "es", "value": "Vulnerabilidad e inyecci\u00f3n SQL en shopping_carg.php de osCommerce anetrior a 2.2 Milestone 2 060817 permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de par\u00e1metros array de id."}], "id": "CVE-2006-4297", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-08-23T01:04:00.000", "references": [{"source": "cve@mitre.org", "url": "http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://securitytracker.com/id?1016719"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://www.gulftech.org/?node=research&article_id=00110-08172006"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/444780/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/19644"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/19774"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28434"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://securitytracker.com/id?1016719"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "http://www.gulftech.org/?node=research&article_id=00110-08172006"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/444780/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/19644"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/19774"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28434"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}