VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability

Bugtraq ID:	17882
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 08 2006 12:00AM
Updated:	May 09 2006 01:54AM
Credit:	tracewar is credited with the discovery of this vulnerability.
Vulnerable:	VP-ASP Shopping Cart
Not Vulnerable:

VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability

VP-ASP Shopping Cart is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions prior to 6.08 are vulnerable; other versions may also be affected.

VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability

This issue can be exploited through a web client.

VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability

Solution:
The vendor has released version 6.08 to address this issue; please see the reference section for further details.

VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability

References:

• VP-ASP 6.00 SQL Injection / Exploit by tracewar([email protected]) (tracewar)
  
• VP-ASP Homepage (Virtual Programming )