EC-CUBE 'image' Parameter Multiple SQL Injection Vulnerabilities

Bugtraq ID:	32177
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 06 2008 12:00AM
Updated:	Nov 10 2008 07:14PM
Credit:	JPCERT/CC
Vulnerable:	EC-CUBE EC-CUBE Community Edition Nightly-Build r17668 EC-CUBE EC-CUBE Community Edition 1.3.5 EC-CUBE EC-CUBE Community Edition 1.3.4 EC-CUBE EC-CUBE 2.3 EC-CUBE EC-CUBE 1.4.7 EC-CUBE EC-CUBE 1.4.6 EC-CUBE EC-CUBE 1.0 EC-CUBE EC-CUBE 2.3.0-rc1 EC-CUBE EC-CUBE 2.2.0-beta EC-CUBE EC-CUBE 2.1.2a EC-CUBE EC-CUBE 2.1.1-beta EC-CUBE EC-CUBE 1.5.0-beta2 EC-CUBE EC-CUBE 1.5.0-beta EC-CUBE EC-CUBE 1.0.1a beta
Not Vulnerable:

EC-CUBE 'image' Parameter Multiple SQL Injection Vulnerabilities

EC-CUBE is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These vulnerabilities affect EC-CUBE 1.x and 2.x.

EC-CUBE 'image' Parameter Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

EC-CUBE 'image' Parameter Multiple SQL Injection Vulnerabilities

Solution:
The vendor has released updates. Please see the references for more information.

EC-CUBE 'image' Parameter Multiple SQL Injection Vulnerabilities

References:

• EC-CUBE security advisories (EC-CUBE)
  
• JVN#19072922 (JVN)