high7.5Public exploit code

CVE-2008-0738

Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via th…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities2008-01-25 · webapps · asp · Verified

Impact

Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idcust parameter to (a) ajax_getTiers.asp and (b) ajax_getCust.asp in ajax/, and the (2) tableName parameter to (c) ajax/ajax_tableFields.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected products

Vendor	Product	Affected versions
Shoppingtree	Candypress Store	through 4.1 Version 4.1.1.26

Weakness classification

CWE-89

Public exploit code

Impact

Affected products

Weakness classification

References