Letterman ID Parameter Multiple SQL Injection Vulnerabilities

Bugtraq ID:	22117
Class:	Input Validation Error
CVE:	CVE-2007-0382
Remote:	Yes
Local:	No
Published:	Jan 18 2007 12:00AM
Updated:	Feb 05 2007 11:08PM
Credit:	Omid is credited with the discovery of these vulnerabilities.
Vulnerable:	VirtueMart Letterman 1.2.3
Not Vulnerable:

Letterman ID Parameter Multiple SQL Injection Vulnerabilities

Letterman is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Letterman ID Parameter Multiple SQL Injection Vulnerabilities

Attackers can exploit these issues via a web client.

Letterman ID Parameter Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Letterman ID Parameter Multiple SQL Injection Vulnerabilities

References:

• [Full-disclosure] The vulnerabilities festival ! (Omid)
  
• Letterman Product Page (VirtueMart)