CVE-2006-6209

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-12-01 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) id2006quant parameter to (a) item_show.asp, or the (2) maingroup or (3) secondgroup parameter to (b) item_list.asp. NOTE: the code_no parameter to Item_Show.asp is covered by CVE-2005-2601.

Affected products

Midicart Software Midicart Asp Plus Shopping Cart: all versions
Midicart Software Midicart Asp Shopping Cart: all versions

References

http://securityreason.com/securityalert/1947
http://www.aria-security.com/forum/showthread.php?t=42
http://www.securityfocus.com/archive/1/452557/100/0/threaded
http://www.securityfocus.com/archive/1/452573/100/0/threaded
http://www.securityfocus.com/bid/21273
https://exchange.xforce.ibmcloud.com/vulnerabilities/30506
http://securityreason.com/securityalert/1947
http://www.aria-security.com/forum/showthread.php?t=42
http://www.securityfocus.com/archive/1/452557/100/0/threaded
http://www.securityfocus.com/archive/1/452573/100/0/threaded
http://www.securityfocus.com/bid/21273
https://exchange.xforce.ibmcloud.com/vulnerabilities/30506

Get alerted when CVE-2006-6209 or the next vulnerability affects your stack