DUware DUpaypal Pro Multiple SQL Injection Vulnerabilities
BID:14034
Info
DUware DUpaypal Pro Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 14034 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 22 2005 12:00AM |
| Updated: | Dec 04 2006 05:54PM |
| Credit: | dedi dwianto <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
DUWare DUportal Pro 3.4.3 DUWare DUpaypal Pro 3.1 DUWare DUpaypal Pro 3.0 DUware DUpaypal 3.1 DUware DUpaypal 3.0 |
| Not Vulnerable: | |
Discussion
DUware DUpaypal Pro Multiple SQL Injection Vulnerabilities
DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
DUware DUpaypal Pro Multiple SQL Injection Vulnerabilities
No exploit is required.
The following proof-of-concept URIs are available:
http://www.example.com/DUpaypalPro/shops/cat.asp?iCat=[SQL Inject]
http://www.example.com/DUpaypalPro/shops/detail.asp?iPro=40[SQL Inject]&iSub=
http://www.example.com/DUpaypalPro/shops/sub.asp?iSub=[SQL Inject]
http://www.example.com/DUpaypalPro/admin/catEdit.asp?iCat=[SQL inject]
No exploit is required.
The following proof-of-concept URIs are available:
http://www.example.com/DUpaypalPro/shops/cat.asp?iCat=[SQL Inject]
http://www.example.com/DUpaypalPro/shops/detail.asp?iPro=40[SQL Inject]&iSub=
http://www.example.com/DUpaypalPro/shops/sub.asp?iSub=[SQL Inject]
http://www.example.com/DUpaypalPro/admin/catEdit.asp?iCat=[SQL inject]
Solution / Fix
DUware DUpaypal Pro Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].
References
DUware DUpaypal Pro Multiple SQL Injection Vulnerabilities
References:
References:
- DUware Homepage (DUware)
- [Aria-Security Team] DuWare DuPaypal SQL Injection Vuln (Aria-Security)
- [ECHO_ADV_19$2005] Multiple SQL INJECTION in DUWARE Products (dedi dwianto