EC-CUBE Multiple Unspecified SQL Injection Vulnerabilities

Bugtraq ID:	50140
Class:	Input Validation Error
CVE:	CVE-2011-3988
Remote:	Yes
Local:	No
Published:	Oct 14 2011 12:00AM
Updated:	Oct 14 2011 12:00AM
Credit:	Tsukada Nobuhisa
Vulnerable:	EC-CUBE EC-CUBE 2.11.2 EC-CUBE EC-CUBE 2.11.1 EC-CUBE EC-CUBE 2.11
Not Vulnerable:	EC-CUBE EC-CUBE 2.11.3

EC-CUBE Multiple Unspecified SQL Injection Vulnerabilities

EC-CUBE is prone to multiple unspecified SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

EC-CUBE 2.11.0 through 2.11.2 are vulnerable; other versions may also be affected.

EC-CUBE Multiple Unspecified SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

EC-CUBE Multiple Unspecified SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please contact the vendor for more information.

EC-CUBE Multiple Unspecified SQL Injection Vulnerabilities

References:

• EC-CUBE Homepage (LOCKON CO. LTD.)
  
• EC-CUBE Weakness Report (Japanese) (EC-CUBE)
  
• EC-CURE Release (Japanese) (EC-CURE)
  
• JVN44496332 (JVN )
  
• JVN44496332 (Japanese) (JVN)
  
• JVNDB-2011-000087 (JVN)