CVE-2007-6466

EPSS 1.2%

Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/4740unverified cve_referencewww.exploit-db.com/exploits/4739unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://newhack.org/advisories/FreeWebShop-2.2.1.txt http://securityreason.com/securityalert/3468 https://exchange.xforce.ibmcloud.com/vulnerabilities/39143 https://www.exploit-db.com/exploits/4739 https://www.exploit-db.com/exploits/4740 http://www.securityfocus.com/bid/26886