CVE-2006-5957 (CNNVD-200611-275)
中文标题:
INFINICART 多个SQL注入漏洞
英文标题:
Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL...
漏洞描述
中文描述:
** 争议 ** INFINICART中存在多个SQL注入漏洞， 远程攻击者可通过在(a)browse_group.asp内的(1)groupid参数，在(b)added_to_cart.asp内的(2)productid参数和在(c)browsesubcat.asp内的(3)catid和(4)subid参数。注：厂商对此报告有争议，指出"所提的漏洞在我们的官方发布产品中不存在，但只在非官方的演示版本中出现。然而，我们还是感谢此信息。我们已经更新了演示版并确保所有漏洞都修复。"
英文描述:
Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| infinicart | infinicart | * | - | - |
cpe:2.3:a:infinicart:infinicart:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
exploitdb
exploitdb
cve.org
exploitdb
exploitdb
exploitdb
exploitdb
CVSS评分详情
AV:N/AC:L/Au:N/C:P/I:P/A:P
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2006-5957 |
2025-11-11 15:17:47 | 2025-11-11 07:32:38 |
| NVD | nvd_CVE-2006-5957 |
2025-11-11 14:51:52 | 2025-11-11 07:41:24 |
| CNNVD | cnnvd_CNNVD-200611-275 |
2025-11-11 15:08:53 | 2025-11-11 07:49:11 |
| EXPLOITDB | exploitdb_EDB-28992 |
2025-11-11 15:05:20 | 2025-11-11 08:24:39 |
| EXPLOITDB | exploitdb_EDB-28993 |
2025-11-11 15:05:20 | 2025-11-11 08:24:39 |
| EXPLOITDB | exploitdb_EDB-28994 |
2025-11-11 15:05:20 | 2025-11-11 08:24:39 |
版本与语言
安全公告
变更历史
查看详细变更
- references_count: 11 -> 13
- tags_count: 5 -> 6
查看详细变更
- references_count: 9 -> 11
- tags_count: 4 -> 5
查看详细变更
- references_count: 6 -> 9
- tags_count: 0 -> 4
- data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> SQL注入
- cnnvd_id: 未提取 -> CNNVD-200611-275
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 7.5
- cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:P/I:P/A:P
- cvss_version: NOT_EXTRACTED -> 2.0
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']