← Database

CVE-2008-0546

HIGH CVSS: 7.5 Published: 2008-02-01 Modified: 2026-06-16

Description

Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idProduct and (2) options parameters to (a) ajax/ajax_optInventory.asp, or the (2) recid parameter to (b) ajax/ajax_getBrands.asp.

Affected Platforms

Shoppingtree Candypress Store

Weakness Type

CWE-89

References