SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities

Bugtraq ID:	24226
Class:	Input Validation Error
CVE:	CVE-2007-2997
Remote:	Yes
Local:	No
Published:	May 29 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	John Martinelli is credited with the discovery of these vulnerabilities.
Vulnerable:	SalesCart Shopping Cart 0
Not Vulnerable:

SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities

SalesCart Shopping Cart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

NOTE: The vendor has stated that this vulnerability affects only a 'noncommercial product demo' that is now obsolete. Please see the references for more information.

SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities

References:

• SalesCart Homepage (SalesCart)
  
• Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection ([email protected])
  
• RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability (John Martinelli)