CVE-2006-6109

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=116372253323469&w=2Mailing List
http://s-a-p.ca/index.php?page=OurAdvisories&id=25Broken Link, URL Repurposed
http://secunia.com/advisories/22954Exploit
http://www.securityfocus.com/bid/21090/infoExploit, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2006/4577Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/30346
http://marc.info/?l=bugtraq&m=116372253323469&w=2Mailing List
http://s-a-p.ca/index.php?page=OurAdvisories&id=25Broken Link, URL Repurposed
http://secunia.com/advisories/22954Exploit
http://www.securityfocus.com/bid/21090/infoExploit, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2006/4577Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/30346

Timeline

Published: Nov 26, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-61107.5Multiple SQL injection vulnerabilities in an unspecified BPG-InfoTech Content Management System product allow remote attackers to execute ar CVE-2006-61117.5Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) prod CVE-2006-61125.0LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under (1) class/ and (2) plugins/, which allows remote CVE-2006-61135.0Monkey Boards 0.3.5 allows remote attackers to obtain sensitive information via direct requests to (1) include/admin_auth.inc.php and (2) in CVE-2006-61157.5SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the fid pa CVE-2006-61167.5SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the k CVE-2006-61177.5SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the w CVE-2006-61186.8Cross-site scripting (XSS) vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web script or HTML via CVE-2006-61195.0mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation p CVE-2006-61206.8Integer overflow in the KPresenter import filter for Microsoft PowerPoint files (filters/olefilters/lib/klaola.cc) in KOffice before 1.6.1 a CVE-2006-61219.3Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run method.CVE-2006-61227.5Multiple buffer overflows in TIN before 1.8.2 have unspecified impact and attack vectors, a different vulnerability than CVE-2006-0804.