LaGarde StoreFront 'SearchResults.aspx' SQL Injection Vulnerability

Bugtraq ID:	28234
Class:	Input Validation Error
CVE:	CVE-2008-1341
Remote:	Yes
Local:	No
Published:	Mar 13 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Nick Merrit is credited with the discovery of this vulnerability.
Vulnerable:	LaGarde StoreFront 6.0
Not Vulnerable:	LaGarde StoreFront 6.0 Service Pack 8

LaGarde StoreFront 'SearchResults.aspx' SQL Injection Vulnerability

StoreFront is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Reports indicate that versions prior to StoreFront 6 Service Pack 8 are vulnerable.

LaGarde StoreFront 'SearchResults.aspx' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

LaGarde StoreFront 'SearchResults.aspx' SQL Injection Vulnerability

Solution:
Reports indicate that StoreFront 6 Service Pack 8 is not vulnerable to this issue. Please see the references and contact the vendor for more information.

LaGarde StoreFront 'SearchResults.aspx' SQL Injection Vulnerability

References:

• StoreFront 6 Knowledge Base (LaGarde)
  
• StoreFront Homepage (LaGarde)