CVE-2006-5957

Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.

• CWE-89

• http://secunia.com/advisories/22865Vendor Advisory
• http://securityreason.com/securityalert/1881
• http://www.attrition.org/pipermail/vim/2006-December/001162.html
• http://www.securityfocus.com/archive/1/451322/100/0/threaded
• http://www.securityfocus.com/bid/21043
• http://www.vupen.com/english/advisories/2006/4501Vendor Advisory
• http://secunia.com/advisories/22865Vendor Advisory
• http://securityreason.com/securityalert/1881
• http://www.attrition.org/pipermail/vim/2006-December/001162.html
• http://www.securityfocus.com/archive/1/451322/100/0/threaded
• http://www.securityfocus.com/bid/21043
• http://www.vupen.com/english/advisories/2006/4501Vendor Advisory

Published

Nov 17, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-5951PHP remote file inclusion vulnerability in pipe.php in Exoph…
• CVE-2006-5952SQL injection vulnerability in admin/default.asp in ASP Smil…
• CVE-2006-5953SQL injection vulnerability in viewcart.asp in Evolve shoppi…
• CVE-2006-5954SQL injection vulnerability in page.asp in NetVIOS 2.0 and e…
• CVE-2006-5955SQL injection vulnerability in listings.asp in 20/20 DataShe…
• CVE-2006-5956XLineSoft PHPRunner 3.1 stores the (1) database server name,…
• CVE-2006-5958Multiple cross-site scripting (XSS) vulnerabilities in INFIN…
• CVE-2006-5959SQL injection vulnerability in browse.asp in A+ Store E-Comm…
• CVE-2006-5960Multiple cross-site scripting (XSS) vulnerabilities in accou…
• CVE-2006-5961Buffer overflow in Mercury Mail Transport System 4.01b for W…
• CVE-2006-5962Multiple SQL injection vulnerabilities in Hpecs Shopping Car…
• CVE-2006-5963Directory traversal vulnerability in PentaZip 8.5.1.190 and …