Dynamic Biz Website Builder (QuickWeb) Login.ASP SQL Injection Vulnerability

Bugtraq ID:	14083
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2005 12:00AM
Updated:	Jun 28 2005 12:00AM
Credit:	Discovery is credited to basher13.
Vulnerable:	EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0
Not Vulnerable:

Dynamic Biz Website Builder (QuickWeb) Login.ASP SQL Injection Vulnerability

Dynamic Biz Website Builder (QuickWeb) is prone to an SQL injection vulnerability.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Dynamic Biz Website Builder (QuickWeb) 1.0 is reportedly vulnerable.

Dynamic Biz Website Builder (QuickWeb) Login.ASP SQL Injection Vulnerability

An exploit is not required.

The following proof of concept is available:
User ID : admin
Password : 'or '='

Dynamic Biz Website Builder (QuickWeb) Login.ASP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Dynamic Biz Website Builder (QuickWeb) Login.ASP SQL Injection Vulnerability

References:

• Dynamic Biz Website Builder (QuickWeb) (EtoShop)
  
• QuickWeb Administration Vulnerability (basher13)