CVE-2006-6109

Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.44% chance of exploitation in the next 30 days, 73rd percentile

Published

2006-11-26

Updated

2024-08-07

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/29038
• https://www.exploit-db.com/exploits/29037

Security advisories

• http://www.securityfocus.com/bid/21090/info

References

• CVE Record
• NVD entry