CVE-2006-6109
published 2006-11-26CVE-2006-6109: Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in…
PriorityP341high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.42%
69.6th percentile
Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| candypress | candypress_store | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
CandyPress CandyPress Store 3.5.2.14 openpolicy.asp brand sql injection (EDB-29037 / XFDB-30346)
vuldb·2026-04-28·CVSS 7.5
CVE-2006-6109 [HIGH] CandyPress CandyPress Store 3.5.2.14 openpolicy.asp brand sql injection (EDB-29037 / XFDB-30346)
A vulnerability was found in CandyPress CandyPress Store 3.5.2.14. It has been classified as critical. This affects an unknown function of the file openpolicy.asp. The manipulation of the argument brand leads to sql injection.
This vulnerability is uniquely identified as CVE-2006-6109. The attack is possible to be carried out remotely. Moreover, an exploit is present.
GHSA
GHSA-mmf6-6grp-f9x4: Multiple SQL injection vulnerabilities in CandyPress Store 3
ghsa_unreviewed·2022-05-01
CVE-2006-6109 [HIGH] CWE-89 GHSA-mmf6-6grp-f9x4: Multiple SQL injection vulnerabilities in CandyPress Store 3
Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy INSERT
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy INSERT"; flow:established,to_server; http.uri; content:"/openPolicy.asp?"; nocase; content:"policy="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007466; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name I
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UNION SELECT
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UNION SELECT"; flow:established,to_server; http.uri; content:"/prodList.asp?"; nocase; content:"brand="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007471; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_na
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UPDATE
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UPDATE"; flow:established,to_server; http.uri; content:"/prodList.asp?"; nocase; content:"brand="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007475; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Acc
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy DELETE
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy DELETE"; flow:established,to_server; http.uri; content:"/openPolicy.asp?"; nocase; content:"policy="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007467; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name I
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UNION SELECT
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UNION SELECT"; flow:established,to_server; http.uri; content:"/openPolicy.asp?"; nocase; content:"policy="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007465; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy SELECT
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy SELECT"; flow:established,to_server; http.uri; content:"/openPolicy.asp?"; nocase; content:"policy="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007464; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name I
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UPDATE
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UPDATE"; flow:established,to_server; http.uri; content:"/openPolicy.asp?"; nocase; content:"policy="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007469; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name In
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand SELECT
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand SELECT"; flow:established,to_server; http.uri; content:"/prodList.asp?"; nocase; content:"brand="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007470; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Ac
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy ASCII
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy ASCII"; flow:established,to_server; http.uri; content:"/openPolicy.asp?"; nocase; content:"policy="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007468; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name I
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand ASCII
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand ASCII"; flow:established,to_server; http.uri; content:"/prodList.asp?"; nocase; content:"brand="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007474; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Ac
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand DELETE
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand DELETE"; flow:established,to_server; http.uri; content:"/prodList.asp?"; nocase; content:"brand="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007473; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_A
Suricata
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6109 [HIGH] ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand INSERT
ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand INSERT"; flow:established,to_server; http.uri; content:"/prodList.asp?"; nocase; content:"brand="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6109; reference:url,www.securityfocus.com/bid/21090/info; classtype:web-application-attack; sid:2007472; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Ac
Exploit-DB
CandyPress Store 3.5.2 14 - 'openPolicy.asp?policy' SQL Injection
exploitdb·2006-11-15
CVE-2006-6109 CandyPress Store 3.5.2 14 - 'openPolicy.asp?policy' SQL Injection
CandyPress Store 3.5.2 14 - 'openPolicy.asp?policy' SQL Injection
---
source: https://www.securityfocus.com/bid/21090/info
CandyPress Store is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
Version 3.5.2.14 is vulnerable; other versions may also be affected.
http://www.example.com/sa3.5.2.14/scripts/openPolicy.asp?policy='[sql]
Exploit-DB
CandyPress Store 3.5.2 14 - 'prodList.asp?brand' SQL Injection
exploitdb·2006-11-15
CVE-2006-6109 CandyPress Store 3.5.2 14 - 'prodList.asp?brand' SQL Injection
CandyPress Store 3.5.2 14 - 'prodList.asp?brand' SQL Injection
---
source: https://www.securityfocus.com/bid/21090/info
CandyPress Store is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
Version 3.5.2.14 is vulnerable; other versions may also be affected.
http://www.example.com/sa3.5.2.14/scripts/prodList.asp?brand='[sql]
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=116372253323469&w=2http://s-a-p.ca/index.php?page=OurAdvisories&id=25http://secunia.com/advisories/22954http://www.securityfocus.com/bid/21090/infohttp://www.vupen.com/english/advisories/2006/4577https://exchange.xforce.ibmcloud.com/vulnerabilities/30346http://marc.info/?l=bugtraq&m=116372253323469&w=2http://s-a-p.ca/index.php?page=OurAdvisories&id=25http://secunia.com/advisories/22954http://www.securityfocus.com/bid/21090/infohttp://www.vupen.com/english/advisories/2006/4577https://exchange.xforce.ibmcloud.com/vulnerabilities/30346
2006-11-26
Published