ASP Stats Generator Pages.ASP SQL Injection Vulnerability

Bugtraq ID:	18512
Class:	Input Validation Error
CVE:	CVE-2006-3580
Remote:	Yes
Local:	No
Published:	Jun 19 2006 12:00AM
Updated:	Jul 06 2016 01:33PM
Credit:	Hamid Ebadi is credited with the discovery of this vulnerability.
Vulnerable:	weppos.com ASP Stats Generator 2.1.1 weppos.com ASP Stats Generator 2.1
Not Vulnerable:

ASP Stats Generator Pages.ASP SQL Injection Vulnerability

ASP Stats Generator is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

ASP Stats Generator versions 2.1.1 and prior are reported vulnerable; other versions may also be affected.

ASP Stats Generator Pages.ASP SQL Injection Vulnerability

No exploit is required.

ASP Stats Generator Pages.ASP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

ASP Stats Generator Pages.ASP SQL Injection Vulnerability

References:

• ASP Stats Generator Web Site (ASP Stats Generator)