CVE-2010-2691: SQL Injection

Published Jul 9, 2010

Updated

Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitrary SQL commands via the (1) sbid parameter to productsdetails.php, (2) pid parameter to products/products.php, and (3) designid parameter to designview.php.

Affected Software

1 affected component

2daybiz Custom T-shirt Design Script

Event History

Jul 9, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-2691?

CVE-2010-2691 has a medium severity rating due to the potential for remote SQL injection attacks.

How do I fix CVE-2010-2691?

To fix CVE-2010-2691, sanitize and validate the input parameters sbid, pid, and designid to prevent SQL injection.

Which software is affected by CVE-2010-2691?

CVE-2010-2691 affects the 2daybiz Custom T-Shirt Design Script.

What types of attacks can CVE-2010-2691 enable?

CVE-2010-2691 can enable remote attackers to execute arbitrary SQL commands against the vulnerable application.

How can I determine if my application is vulnerable to CVE-2010-2691?

To determine vulnerability to CVE-2010-2691, test the application for SQL injection via the specified parameters.