CVE-2006-4267

Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.

• http://bugs.cubecart.com/?do=details&id=523Exploit
• http://retrogod.altervista.org/cubecart_3011_adv.htmlExploit
• http://retrogod.altervista.org/cubecart_3011_sql.htmlExploit
• http://retrogod.altervista.org/cubecart_3011_sql_mqg_bypass.htmlExploit
• http://secunia.com/advisories/21538Patch, Vendor Advisory
• http://securityreason.com/securityalert/1429
• http://securitytracker.com/id?1016708
• http://www.cubecart.com/site/forums/index.php?showtopic=21247Patch
• http://www.osvdb.org/27984
• http://www.osvdb.org/27985
• http://www.securityfocus.com/archive/1/443476/100/0/threaded
• http://www.securityfocus.com/bid/19563Exploit
• http://www.vupen.com/english/advisories/2006/3314
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28428
• http://bugs.cubecart.com/?do=details&id=523Exploit
• http://retrogod.altervista.org/cubecart_3011_adv.htmlExploit
• http://retrogod.altervista.org/cubecart_3011_sql.htmlExploit
• http://retrogod.altervista.org/cubecart_3011_sql_mqg_bypass.htmlExploit
• http://secunia.com/advisories/21538Patch, Vendor Advisory
• http://securityreason.com/securityalert/1429
• http://securitytracker.com/id?1016708
• http://www.cubecart.com/site/forums/index.php?showtopic=21247Patch
• http://www.osvdb.org/27984
• http://www.osvdb.org/27985
• http://www.securityfocus.com/archive/1/443476/100/0/threaded
• http://www.securityfocus.com/bid/19563Exploit
• http://www.vupen.com/english/advisories/2006/3314
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28428

Published

Aug 21, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4261Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-4262Multiple buffer overflows in cscope 15.5 and earlier allow u…
• CVE-2006-4263Multiple PHP remote file inclusion vulnerabilities in the Pr…
• CVE-2006-4264Multiple PHP remote file inclusion vulnerabilities in the lm…9.8
• CVE-2006-4265Kaspersky Anti-Hacker 1.8.180, when Stealth Mode is enabled,…
• CVE-2006-4266Symantec Norton Personal Firewall 2006 9.1.0.33, and possibl…
• CVE-2006-4268Multiple cross-site scripting (XSS) vulnerabilities in CubeC…
• CVE-2006-4269PHP remote file inclusion vulnerability in admin.x-shop.php …
• CVE-2006-4270PHP remote file inclusion vulnerability in mambelfish.class.…
• CVE-2006-4271PHP remote file inclusion vulnerability in install/upgrade_3…
• CVE-2006-4272Jelsoft vBulletin 3.5.4 allows remote attackers to register …
• CVE-2006-4273Cross-site scripting (XSS) vulnerability in Jelsoft vBulleti…