Web4Future eCommerce Enterprise Edition Multiple SQL Injection Vulnerabilities
BID:15707
Info
Web4Future eCommerce Enterprise Edition Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 15707 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 05 2005 12:00AM |
| Updated: | Dec 05 2005 12:00AM |
| Credit: | Discovered by rakstija r0t3d3Vil. |
| Vulnerable: |
Web4Future eCommerce Home Edition Web4Future eCommerce Enterprise Edition 2.1 |
| Not Vulnerable: | |
Discussion
Web4Future eCommerce Enterprise Edition Multiple SQL Injection Vulnerabilities
eCommerce Enterprise Edition is prone to multiple SQL injection vulnerabilities.
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
eCommerce Enterprise Edition 2.1 and prior and eCommerce Home Edition are vulnerable to these issues.
eCommerce Enterprise Edition is prone to multiple SQL injection vulnerabilities.
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
eCommerce Enterprise Edition 2.1 and prior and eCommerce Home Edition are vulnerable to these issues.
Exploit / POC
Web4Future eCommerce Enterprise Edition Multiple SQL Injection Vulnerabilities
No exploit is required.
Example URI have been provided:
http://www.example.com/view.php?prod=[SQL]
http://www.example.com/viewbrands.php?bid=[SQL]
http://www.example.com/view.php?prod=1010001&brid=[SQL]
http://www.example.com/index.php?action=ViewGroups&grp=[SQL]
http://www.example.com/index.php?action=ViewCategories&cat=[SQL]
No exploit is required.
Example URI have been provided:
http://www.example.com/view.php?prod=[SQL]
http://www.example.com/viewbrands.php?bid=[SQL]
http://www.example.com/view.php?prod=1010001&brid=[SQL]
http://www.example.com/index.php?action=ViewGroups&grp=[SQL]
http://www.example.com/index.php?action=ViewCategories&cat=[SQL]
Solution / Fix
Web4Future eCommerce Enterprise Edition Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Web4Future eCommerce Enterprise Edition Multiple SQL Injection Vulnerabilities
References:
References:
- eCommerce Enterprise Edition SQL inj. vuln. (rakstija r0t3d3Vil)
- eCommerce Enterprise Edition v2.1 (Web4Future)