OsCommerce Product_info.PHP SQL Injection Vulnerability

Bugtraq ID:	19774
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2006 12:00AM
Updated:	Sep 04 2006 06:58PM
Credit:	James Bercegay of the GulfTech Security Research Team is credited with the discovery of this vulnerability.
Vulnerable:	osCommerce osCommerce 2.2 ms2 05113 update osCommerce osCommerce 2.2 ms2 05112 update osCommerce osCommerce 2.2 ms2 osCommerce osCommerce 2.2 ms1 osCommerce osCommerce 2.2 cvs osCommerce osCommerce 2.1
Not Vulnerable:	osCommerce osCommerce 2.2 ms2 060817 Update

OsCommerce Product_info.PHP SQL Injection Vulnerability

osCommerce is prone to an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

OsCommerce Product_info.PHP SQL Injection Vulnerability

Attackers can exploit this issue via a web client.

The following proof of concept is available:

• /data/vulnerabilities/exploits/19774.php

OsCommerce Product_info.PHP SQL Injection Vulnerability

Solution:
The vendor has released version 2.2 Milestone 2 060817 to address this issue; please see the reference section for details.


osCommerce osCommerce 2.2 ms2

• osCommerce osCommerce 2.2 Milestone 2 Update 060817
  http://www.oscommerce.com/solutions/downloads

OsCommerce Product_info.PHP SQL Injection Vulnerability

References:

• osCommerce 2.2 Milestone 2 060817 Update Released (osCommerce)
  
• osCommerce Homepage (osCommerce)