CVE-2006-6464 Business logic in n/a

Medium 5.0 Published 11 Dec 2006 Updated 7 Aug 2024

Attackers can manipulate quantity fields to reduce shopping cart totals, leading to financial loss for e-commerce businesses using Midicart.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2006-6464?

CVE-2006-6464 is a medium-severity vulnerability in n/a, published on 11 Dec 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.

Which versions are affected by CVE-2006-6464?

It affects 1 product.

Products include Midicart Software Midicart Php Shopping Cart.

How do I fix CVE-2006-6464?

No fix has been published for CVE-2006-6464 yet. Limit exposure of the affected software until one is available.

Is CVE-2006-6464 being exploited?

There is no known exploitation of CVE-2006-6464 in the wild and no public exploit code.

Sources

Also known as GHSA-83hr-3993-2xh9.