CVE-2006-1098

CVE-2006-1098 describes multiple SQL injection vulnerabilities in NZ Ecommerce, specifically affecting the digital_builder nz_ecommerce product. Attackers can exploit these flaws by manipulating the informationID or ParentCategory parameters in index.php to execute arbitrary SQL commands. The vulnerability carries a CVSS score of 7.5, indicating a high severity with a network-based attack vector, low complexity, and potential for partial compromise of confidentiality, integrity, and availability. While the vendor disputed the issue, research suggests it is legitimate, and an exploit is available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.