VirtuaStore Password Parameter SQL Injection Vulnerability

Bugtraq ID:	18790
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2006 12:00AM
Updated:	Jul 04 2006 11:19PM
Credit:	supermalhacao is credited with the discovery of this vulnerability.
Vulnerable:	VirtuaStore VirtuaStore 2.0
Not Vulnerable:

VirtuaStore Password Parameter SQL Injection Vulnerability

VirtuaStore is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

VirtuaStore Password Parameter SQL Injection Vulnerability

These issues can be exploited through a web client.

The following entered in the password field is sufficient to exploit this issue:

123456 / ' or 1=1

VirtuaStore Password Parameter SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].

VirtuaStore Password Parameter SQL Injection Vulnerability

References:

• VirtuaStore Forum (VirtuaStore)