Lizard Cart CMS Multiple SQL Injection Vulnerabilities
BID:16140
Info
Lizard Cart CMS Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 16140 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 04 2006 12:00AM |
| Updated: | Jan 04 2006 12:00AM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of this vulnerability. |
| Vulnerable: |
Lizard Cart Lizard Cart CMS 1.0.4 |
| Not Vulnerable: | |
Discussion
Lizard Cart CMS Multiple SQL Injection Vulnerabilities
Lizard Cart CMS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Lizard Cart CMS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Lizard Cart CMS Multiple SQL Injection Vulnerabilities
An exploit is not required.
Example URI have been provided:
http://www.example.com/lizard/pages.php?id=-1'%20union%20select%201,2,3/*
http://www.example.com/lizard/detail.php?id=-1'%20union%20select%201,2,3,4,5,6,7,8/*
An exploit is not required.
Example URI have been provided:
http://www.example.com/lizard/pages.php?id=-1'%20union%20select%201,2,3/*
http://www.example.com/lizard/detail.php?id=-1'%20union%20select%201,2,3,4,5,6,7,8/*
Solution / Fix
Lizard Cart CMS Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Lizard Cart CMS Multiple SQL Injection Vulnerabilities
References:
References:
- Lizard Cart CMS SQL Injection Vulnerability (eVuln)
- Lizard Cart Web Site (Lizard Cart)