NVD

Id
62855  
Name
CVE-2006-4214  
Description
Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session function in ipn_main_handler.php, which can be leveraged to modify elements of $_SESSION; and allow remote authenticated users to execute arbitrary SQL commands via (2) a session id within a cookie to whos_online_session_recreate, (3) the quantity field to the add_cart function, (4) an id[] parameter when adding an item to a shopping cart, or (5) a redemption code when checking out (dc_redeem_code parameter to includes/modules/order_total/ot_coupon.php).  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2006-08-17  
Modified Date
2011-09-06  
Seq
2006-4214  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
326819 62855 CVE-2006-4214 http://www.gulftech.org/?node=research&article_id=00109-08152006  View
326820 62855 CVE-2006-4214 19542  View
326821 62855 CVE-2006-4214 ADV-2006-3283  View
326822 62855 CVE-2006-4214 http://www.zen-cart.com/forum/showthread.php?t=43579  View
326823 62855 CVE-2006-4214 zencart-multiple-scripts-sql-injection(28393)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
60774 JVNDB-2006-003040 Zen Cart における SQL インジェクションの脆弱性 Zen Cart には、SQL インジェクションの脆弱性が存在します。 CVE-2006-4214 20316 CVE-2006-4214 62855 7.5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-003040.html 2006-08-17 2012-12-20 View