MX Shop Index.PHP Multiple SQL Injection Vulnerabilities
BID:14876
Info
MX Shop Index.PHP Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 14876 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3004 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 19 2005 12:00AM |
| Updated: | Dec 20 2006 10:57PM |
| Credit: | David Sopas Ferreira is credited with the discovery of this vulnerability. |
| Vulnerable: |
InterAKT Online MX Shop 3.2 .0 |
| Not Vulnerable: |
InterAKT Online MX Shop 3.6 |
Discussion
MX Shop Index.PHP Multiple SQL Injection Vulnerabilities
MX Shop is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
MX Shop is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
MX Shop Index.PHP Multiple SQL Injection Vulnerabilities
No exploit is required.
Some examples have been provided:
http://www.example.com/index.php?mod=pages&idp='[SQL INJECTION]
http://www.example.com/index.php?mod=pages&id_ctg='[SQL INJECTION]
http://www.example.com/index.php?mod=pages&id_prd='[SQL INJECTION]
No exploit is required.
Some examples have been provided:
http://www.example.com/index.php?mod=pages&idp='[SQL INJECTION]
http://www.example.com/index.php?mod=pages&id_ctg='[SQL INJECTION]
http://www.example.com/index.php?mod=pages&id_prd='[SQL INJECTION]
Solution / Fix
MX Shop Index.PHP Multiple SQL Injection Vulnerabilities
Solution:
The vendor has addressed this issue in MX Shop version 3.6.0 and later. Contact the vendor for information on obtaining the appropriate updates.
Solution:
The vendor has addressed this issue in MX Shop version 3.6.0 and later. Contact the vendor for information on obtaining the appropriate updates.
References
MX Shop Index.PHP Multiple SQL Injection Vulnerabilities
References:
References:
- InterAKT Online Homepage (InterAKT Online )
- MX Shop Web Site (MX Shop)
- SS#15092005 - MX Shop 3.2.0 SQL Injection ([email protected])