Zen Cart Multiple SQL Injection Vulnerabilities

Bugtraq ID:	19542
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 15 2006 12:00AM
Updated:	Aug 31 2006 08:03PM
Credit:	James Bercegay is credited with the discovery of these vulnerabilities.
Vulnerable:	Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.1.2 d Zen Cart Web Shopping Cart 1.3.0.2
Not Vulnerable:

Zen Cart Multiple SQL Injection Vulnerabilities

Zen Cart is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful attack could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect version 1.3.0.2; earlier versions may also be vulnerable.

Zen Cart Multiple SQL Injection Vulnerabilities

Attackers can exploit this issue via a web client.

Zen Cart Multiple SQL Injection Vulnerabilities

Solution:
The vendor has released a fix for these issues; please see the reference section for details.

Zen Cart Multiple SQL Injection Vulnerabilities

References:

• Vendor Home Page (Zen Cart)
  
• Zen Cart Multiple Vulnerabilities (James Bercegay)
  
• Zen Cart Vulnerability Update (SQL injection) (Zen Cart)