CVE-2006-6209 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.4% (pctl 72)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) id2006quant parameter to (a) item_show.asp, or the (2) maingroup or (3) secondgroup parameter to (b) item_list.asp. NOTE: the code_no parameter to Item_Show.asp is covered by CVE-2005-2601.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.39% — more likely to be exploited than 72% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-12-01 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| midicart software | midicart asp plus shopping cart |
| midicart software | midicart asp shopping cart |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | MidiCart ASP - 'Item_Show.asp?ID2006quant' SQL Injection | 2006-11-24 |
References
- http://securityreason.com/securityalert/1947
- http://www.aria-security.com/forum/showthread.php?t=42
- http://www.securityfocus.com/archive/1/452557/100/0/threaded
- http://www.securityfocus.com/archive/1/452573/100/0/threaded
- http://www.securityfocus.com/bid/21273
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30506
- http://securityreason.com/securityalert/1947
- http://www.aria-security.com/forum/showthread.php?t=42
- http://www.securityfocus.com/archive/1/452557/100/0/threaded
- http://www.securityfocus.com/archive/1/452573/100/0/threaded
- http://www.securityfocus.com/bid/21273
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30506
→ the Explorer · watch your stack · NVD