high7.5Public exploit code
CVE-2006-1098
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NZ eCommerce System - 'index.php' Multiple SQL Injections2006-03-02 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Digital Builder | Nz Ecommerce | All versions |
References
- NVD record
- CVE.org record
- http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html
- http://secunia.com/advisories/19088
- http://www.osvdb.org/23601
- http://www.securityfocus.com/bid/16931
- http://www.vupen.com/english/advisories/2006/0803
- http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html
- http://secunia.com/advisories/19088
- http://www.osvdb.org/23601
- http://www.securityfocus.com/bid/16931
- http://www.vupen.com/english/advisories/2006/0803