high7.5Public exploit code
CVE-2007-6466
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FreeWebShop 2.2.1 - Blind SQL Injection2007-12-18 · webapps · php · Verified
- MOG-WebShop - 'index.php?group' SQL Injection2007-12-18 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freewebshop | Freewebshop | Version 2.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://newhack.org/advisories/FreeWebShop-2.2.1.txt
- http://securityreason.com/securityalert/3468
- http://www.securityfocus.com/bid/26886
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39143
- https://www.exploit-db.com/exploits/4739
- https://www.exploit-db.com/exploits/4740
- http://newhack.org/advisories/FreeWebShop-2.2.1.txt
- http://securityreason.com/securityalert/3468
- http://www.securityfocus.com/bid/26886
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39143
- https://www.exploit-db.com/exploits/4739
- https://www.exploit-db.com/exploits/4740