28662Third-party advisory
http://secunia.com/advisories/28662 CVE-2008-0546
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
Record summary
CVE-2008-0546 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idProduct and (2) options parameters to (a) ajax/ajax_optInventory.asp, or the (2) recid parameter to (b) ajax/ajax_getBrands.asp.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBCandyPress eCommerce suite 4.1.1.26 - Multiple VulnerabilitiesExploitDB exploitby BugReport.IRNot analyzed1 file
References
93600Third-party advisory
http://securityreason.com/securityalert/3600 candypress.comConfirmation
http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1 20080125 [CandyPress] eCommerce suite (SQL Injection + XSS + Path Disclosure)mailing list
http://www.securityfocus.com/archive/1/487058/100/0/threaded 27454vdb entry
http://www.securityfocus.com/bid/27454 ADV-2008-0314vdb entry
http://www.vupen.com/english/advisories/2008/0314 ecommercesuite-ajaxgetbrands-sql-injection(39939)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/39939 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-0546 4988exploit
https://www.exploit-db.com/exploits/4988