Описание
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2007-6466
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39143
- https://www.exploit-db.com/exploits/4739
- https://www.exploit-db.com/exploits/4740
- http://newhack.org/advisories/FreeWebShop-2.2.1.txt
- http://securityreason.com/securityalert/3468
- http://www.securityfocus.com/bid/26886
Связанные уязвимости
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.