CVE-2007-6466
HighSummary
Wielokrotne podatności na wstrzykiwanie SQL w pliku index.php w FreeWebshop 2.2.1 umożliwiają zdalnym atakującym wykonywanie dowolnych poleceń SQL poprzez parametry prod, cat oraz group w różnych akcjach. Problem dotyczy również produktu MOG - Web Shop, który bazuje na tym samym kodzie.
Risk Assessment
Atakujący mogą uzyskać dostęp do bazy danych, co może prowadzić do ujawnienia wrażliwych informacji lub modyfikacji danych. To stwarza poważne zagrożenie dla integralności i poufności danych organizacji.
Recommendation
Zaleca się aktualizację do najnowszej wersji FreeWebshop oraz wdrożenie odpowiednich zabezpieczeń, takich jak filtrowanie danych wejściowych, aby zapobiec wstrzykiwaniu SQL.
Related vulnerabilities
- CVE-2026-87827Critical
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker can execute arbitrary system commands, potentially leading to complete compromise. Exploited by Mirai_ptea and Mirai_aurora botnets for malware propagation and DDoS.
- CVE-2026-85978Critical
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy allows authentication bypass and access to an endpoint that executes attacker-supplied script code without sandboxing, leading to arbitrary code execution.
- CVE-2026-79696Critical
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
- CVE-2026-16272Critical
Use of less trusted source vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects versions from v9.0.0 before v9.0.3.
- CVE-2026-21102Critical
Use-after-free vulnerability in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-87654Critical
Buffer overflow in ANGLE in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-87650Critical
Out-of-bounds read in WebGL in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-87646Critical
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.