CVE-2006-6109
CandyPress Store 3.5.2.14 - SQL Injection via Policy or Brand Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-6109. PoCs published by laurent gaffie.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in CandyPress Store version 3.5.2.14, where the 'brand' parameter in 'prodList.asp' is not properly sanitized. It includes a sample exploit URL but lacks actual exploit code or proof-of-concept implementation.
Description
Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.
Exploits (2)
The provided text describes a SQL injection vulnerability in CandyPress Store version 3.5.2.14, where the 'brand' parameter in 'prodList.asp' is not properly sanitized. It includes a sample exploit URL but lacks actual exploit code or proof-of-concept implementation.
The provided text describes a SQL injection vulnerability in CandyPress Store version 3.5.2.14, where the 'policy' parameter in 'openPolicy.asp' is not properly sanitized. It includes a sample exploit URL but lacks actual exploit code or payload details.