SepCity Shopping Mall 'shpdetails.asp' SQL Injection Vulnerability

Bugtraq ID:	33039
Class:	Input Validation Error
CVE:	CVE-2008-6151
Remote:	Yes
Local:	No
Published:	Dec 29 2008 12:00AM
Updated:	Apr 13 2015 09:12PM
Credit:	Osmanizim
Vulnerable:	SepCity Shopping Mall 0
Not Vulnerable:

SepCity Shopping Mall 'shpdetails.asp' SQL Injection Vulnerability

SepCity Shopping Mall is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SepCity Shopping Mall 'shpdetails.asp' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://localhost/shopmall/shpdetails.asp?ID=1 union select 0,1,2,username,password,5,6,7,8,9 from administrators

SepCity Shopping Mall 'shpdetails.asp' SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

SepCity Shopping Mall 'shpdetails.asp' SQL Injection Vulnerability

References:

• Shopping Mall Homepage (SepCity)
  
• Fixed Security Issues in our Free ASP Apps (Sepcity)