CVE-2006-4267
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to...
CVE-2006-4267 is a high vulnerability (CVSS 7.5) in Devellion Cubecart, published August 21, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.64%, the 89th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 3.64%EPSS, 89th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | CubeCart 3.0.11 - 'oid' Blind SQL Injection | 2006-08-17 |
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
- Record
CVE-2006-4267- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
- Record
CVE-2006-4267- Updated
- 2026-11-02
EUVDEUVD-2006-4255No score
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
- Record
EUVD-2006-4255- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6f29-gxwm-27mxNo score
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to...
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
- Record
GHSA-6f29-gxwm-27mx- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/21538
vupen.com/english/advisories/2006/3314
osvdb.org/27985
securityfocus.com/archive/1/443476/100/0/threaded
bugs.cubecart.com?do=details&id=523
exchange.xforce.ibmcloud.com/vulnerabilities/28428
Show 10 moreShow less
cubecart.com/site/forums/index.php?showtopic=21247
retrogod.altervista.org/cubecart_3011_sql.html
securityreason.com/securityalert/1429
securitytracker.com/id?1016708
nvd.nist.gov/vuln/detail/CVE-2006-4267
github.com/advisories/GHSA-6f29-gxwm-27mx