CVE-2005-2206

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in CartWIZ allow remote attackers to modify SQL statements via the (1) idProduct parameter to tellAFriend.asp, (2) sortType parameter to viewSupportTickets.asp, or the id parameter to (3) updateCreditCards.asp or (4) deleteCreditCards.asp.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-22074.3Cross-site scripting (XSS) vulnerability in store/login.asp in CartWIZ allows remote attackers to inject arbitrary web script or HTML via th CVE-2005-22085.0PrivaShare 1.1b allows remote attackers to cause a denial of service (crash) via a malformed message.CVE-2005-22095.5Capturix ScanShare 1.06 build 50 stores sensitive information such as the password in cleartext in capturixss_cfg.ini, which is readable by CVE-2005-22107.5Stack-based buffer overflow in Internet Download Manager 4.05 allows remote attackers to execute arbitrary code via a long URL.CVE-2005-22114.6Backup Manager 0.5.8a creates temporary files insecurely, which allows local users to conduct unauthorized file operations when a user is bu CVE-2005-22126.4Backup Manager 0.5.8a creates an archive repository with world readable and writable permissions, which allows attackers to modify or read t CVE-2005-22137.5Buffer overflow in the mms_interp_header function in mms.c in MMS Ripper before 0.6.4 might allow remote attackers to execute arbitrary code CVE-2005-22144.6apt-setup in Debian GNU/Linux installs the apt.conf file with insecure permissions, which allows local users to obtain sensitive information CVE-2005-22154.3Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject ar CVE-2005-22167.5PHP remote file inclusion vulnerability in gals.php in PhotoGal Photo Gallery 1.5 and earlier allows remote attackers to execute arbitrary c CVE-2005-22175.0Dansie Shopping Cart stores the vars.dat file under the web root with insufficient access control, which might allow remote attackers to obt CVE-2005-22187.2The device file system (devfs) in FreeBSD 5.x does not properly check parameters of the node type when creating a device node, which makes h