BugMall Shopping Cart Multiple Input Validation Vulnerabilities

Bugtraq ID:	24629
Class:	Input Validation Error
CVE:	CVE-2007-3447 CVE-2007-3448
Remote:	Yes
Local:	No
Published:	Jun 25 2007 12:00AM
Updated:	Jun 28 2007 03:18AM
Credit:	t0pP8uZz and xprog are credited with the discovery of these vulnerabilities.
Vulnerable:	BugMall BugMall Shopping Cart 2.5
Not Vulnerable:

BugMall Shopping Cart Multiple Input Validation Vulnerabilities

BugMall Shopping Cart is prone to input-validation vulnerabilities, including an SQL-injection issue and a cross-site scripting issue, because the application fails to sanitize user-supplied input.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

BugMall Shopping Cart 2.5 and prior versions are affected.

BugMall Shopping Cart Multiple Input Validation Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

• /data/vulnerabilities/exploits/24627.html

BugMall Shopping Cart Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

BugMall Shopping Cart Multiple Input Validation Vulnerabilities

References:

• Bugmall Shopping Cart Web Site (Bugmall)