CVE-2006-4214: SQL Injection
Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipngetstoredsession function in ipnmainhandler.php, which can be leveraged to modify elements of $SESSION; and allow remote authenticated users to execute arbitrary SQL commands via (2) a session id within a cookie to whosonlinesessionrecreate, (3) the quantity field to the addcart function, (4) an id[] parameter when adding an item to a shopping cart, or (5) a redemption code when checking out (dcredeemcode parameter to includes/modules/ordertotal/otcoupon.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4214?
CVE-2006-4214 is considered to have a high severity due to its SQL injection vulnerabilities that can lead to unauthorized database access.
How do I fix CVE-2006-4214?
To fix CVE-2006-4214, upgrade to Zen Cart version 1.3.0.3 or later, which addresses the SQL injection vulnerabilities.
Who is affected by CVE-2006-4214?
CVE-2006-4214 affects all installations of Zen Cart version 1.3.0.2 and earlier.
What systems are vulnerable to CVE-2006-4214?
Systems running Zen Cart version 1.3.0.2 and prior versions are vulnerable to CVE-2006-4214.
Can CVE-2006-4214 be exploited remotely?
Yes, CVE-2006-4214 can be exploited remotely by attackers to execute arbitrary SQL commands.