CVE-2006-7170

Koan Software Mega Mall - SQL Injection

Title source: rule
STIX 2.1

Description

Multiple SQL injection vulnerabilities in Koan Software Mega Mall allow remote attackers to execute arbitrary SQL commands via the (1) t, (2) productId, (3) sk, (4) x, or (5) so parameter to (a) product_review.php; or the (6) orderNo parameter to (b) order-track.php.

Exploits (2)

exploitdb WRITEUP VERIFIED
by laurent gaffie · textwebappsphp
https://www.exploit-db.com/exploits/29026
exploitdb WRITEUP VERIFIED
by laurent gaffie · textwebappsphp
https://www.exploit-db.com/exploits/29027

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/21072
Third Party Advisory mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=116343783720459&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/30214

Scores

EPSS 0.0059
EPSS Percentile 69.4%

Details

CWE
CWE-89
Status published
Products (1)
koan_software/mega_mall
Published Mar 20, 2007
Tracked Since Feb 18, 2026