Evolve Merchant Viewcart.ASP SQL Injection Vulnerability

Bugtraq ID:	21070
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 14 2006 12:00AM
Updated:	Dec 05 2006 06:34PM
Credit:	Laurent Gaffi and Benjamin Moss are credited with the discovery of this vulnerability.
Vulnerable:	Lynx Internet Solutions Evolve Merchant 0
Not Vulnerable:

Evolve Merchant Viewcart.ASP SQL Injection Vulnerability

Evolve Merchant is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Evolve Merchant Viewcart.ASP SQL Injection Vulnerability

Attackers can exploit this issue via a web client.

An example URI is as follows:

http://www.example.com/viewcart.asp?zoneid=[sql]

Evolve Merchant Viewcart.ASP SQL Injection Vulnerability

Solution:
The vendor released a fix to address this issue. Please contact the vendor for further information on obtaining and applying the fix.

Evolve Merchant Viewcart.ASP SQL Injection Vulnerability

References:

• Re: Evolve Merchant[ injection sql ] ( [email protected])
  
• Evolve Merchant[ injection sql ] ([email protected])
  
• Vendor Home Page (Lynx Internet Solutions)