WWWeb Cocepts CactuShop Multiple SQL Injection Vulnerabilities

Bugtraq ID:	21076
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 15 2006 12:00AM
Updated:	Nov 16 2006 10:46PM
Credit:	Aria-Security Team is credited with the discovery of these vulnerabilities.
Vulnerable:	WWWeb Concepts CactuShop 5.0.9
Not Vulnerable:

WWWeb Cocepts CactuShop Multiple SQL Injection Vulnerabilities

WWWeb Concepts CactuShop is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

WWWeb Cocepts CactuShop Multiple SQL Injection Vulnerabilities

Attackers can exploit these issues via a web client.

WWWeb Cocepts CactuShop Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

WWWeb Cocepts CactuShop Multiple SQL Injection Vulnerabilities

References:

• Home Page (WWWeb Concepts)
  
• WWWeb Cocepts SQL Injection (Aria-Security Team)