CVE-2006-2053

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-04-26 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm. NOTE: these issues can also be exploited for path disclosure.

Affected products

Quickestore: 7.9

References

http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html
http://secunia.com/advisories/19817
http://www.osvdb.org/24976
http://www.osvdb.org/24977
http://www.osvdb.org/24978
http://www.osvdb.org/24979
http://www.osvdb.org/24980
http://www.vupen.com/english/advisories/2006/1514
https://exchange.xforce.ibmcloud.com/vulnerabilities/26045
http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html
http://secunia.com/advisories/19817
http://www.osvdb.org/24976

Get alerted when CVE-2006-2053 or the next vulnerability affects your stack