Virtual Programming VP-ASP SQL Injection Vulnerability
BID:4861
Info
Virtual Programming VP-ASP SQL Injection Vulnerability
| Bugtraq ID: | 4861 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 27 2002 12:00AM |
| Updated: | May 27 2002 12:00AM |
| Credit: | Discovered by Noam Rathaus <[email protected]>. |
| Vulnerable: |
Virtual Programming VP-ASP 4.00 |
| Not Vulnerable: | |
Discussion
Virtual Programming VP-ASP SQL Injection Vulnerability
Virtual Programming VP-ASP is a shopping cart application for e-commerce enabled sites.
A SQL injection vulnerability has been reported in some versions of Virtual Programming VP-ASP.
User supplied input is not sanitized before being used in a SQL query. Consequently, query modification using malformed input is possible.
It has been reported that exploitation of this vulnerability may allow for authentication to be bypassed.
Virtual Programming VP-ASP is a shopping cart application for e-commerce enabled sites.
A SQL injection vulnerability has been reported in some versions of Virtual Programming VP-ASP.
User supplied input is not sanitized before being used in a SQL query. Consequently, query modification using malformed input is possible.
It has been reported that exploitation of this vulnerability may allow for authentication to be bypassed.
Solution / Fix
Virtual Programming VP-ASP SQL Injection Vulnerability
Solution:
The vendor has suggested the administration page be moved to an unpredictable location:
You can hide the name of the VP-ASP administration page. Hackers will not be able to even locate the VP-ASP administration page.
From VP-ASP 3.0 and higher set the following in shop$config.asp
const xAdminPage="youradminpagename.asp"
const xShowAdmin="No"
Solution:
The vendor has suggested the administration page be moved to an unpredictable location:
You can hide the name of the VP-ASP administration page. Hackers will not be able to even locate the VP-ASP administration page.
From VP-ASP 3.0 and higher set the following in shop$config.asp
const xAdminPage="youradminpagename.asp"
const xShowAdmin="No"
References
Virtual Programming VP-ASP SQL Injection Vulnerability
References:
References:
- VP-ASP Homepage (Virtual Programming )
- VP-ASP Security FAQ (Virtual Programming)