Web Inhabit A+ Store E-Commerce Input Validation Vulnerabilities

Bugtraq ID:	21092
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 15 2006 12:00AM
Updated:	Nov 16 2006 10:31PM
Credit:	Laurent Gaffié and Benjamin Moss are credited with the discovery of these vulnerabilities.
Vulnerable:	Web Inhabit A+ Store E-Commerce 0
Not Vulnerable:

Web Inhabit A+ Store E-Commerce Input Validation Vulnerabilities

A+ Store E-Commerce is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues include multiple HTML-injection issues and an SQL-injection issue.

Successfully exploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

Web Inhabit A+ Store E-Commerce Input Validation Vulnerabilities

Attackers can exploit these issues via a web client.

Web Inhabit A+ Store E-Commerce Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Web Inhabit A+ Store E-Commerce Input Validation Vulnerabilities

References:

• Vendor Home Page (Web Inhabit)