Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:infinicart:infinicart:*:*:*:*:*:*:*:* | all versions | Vulnerable | Infinicart |
- cpe:2.3:a:infinicart:infinicart:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Infinicart
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-5957
- 2026-10-03 Alias added: GHSA-3rpf-v574-x42r
References
Advisory 2
More Infinicart vulnerabilities
- TI-2006-05740 Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2006-5957 · CVE Program
- CVE-2006-5957 · NVD
- FIRST EPSS
- GHSA-3rpf-v574-x42r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences