SalesCart Shopping Cart SQL Injection Vulnerability

WARNING! Fake news / Uwaga! Nota nieprawdziwa

SalesCart Shopping Cart SQL Injection Vulnerability

2007.06.05

Credit: John Martinelli

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2007-2997

CWE: CWE-89

Ogólna skala CVSS: 7.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

SalesCart Shopping Cart - SQL Injection Vulnerability

SalesCart does not sanitize any forms in cgi-bin/reorder2.asp, allowing an attacker to inject arbitrary SQL queries, as well as possible command execution.

Google d0rk: "Sorry, you have no Items in your Shopping Cart !" inurl:cgi-bin/view1.asp
Vulnerable Variable: All forms in reorder2.asp
Vulnerable File: cgi-bin/reorder2.asp (password: x' OR 'x'='x)
Vendor Status: Notified multiple times, no response. Possible silent patch.

John Martinelli
john (at) martinelli (dot) com [email concealed]

RedLevel Security
RedLevel.org

May 30th, 2007

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

SalesCart Shopping Cart SQL Injection Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.