################################################# ###### SAP's web module OLK: SQL Injection ###### ################################################# $ Author: salcho - salchoman (at) gmail (dot) com [email concealed] $ Home : CSL Labs $ Date : 27/06/2010 $######################################################### [+] Vendor : http://www.topmanage.com.pa/ [+] Product : http://www.topmanage.com.pa/products/1/ [+] Version : 1.91.30 [Prior versions might be vulnerable too.] [+] Dork : inurl: /olk/c_p $#######################DISCLAIMER######################## The author does not take any responsibility for the use this information might be put to. All the information provided here is for educational purposes only. The authir is no way responsible for any misuse of the information. $#####################SQL INJECTION####################### [+] Affected: /olk/c_p/searchCart.asp [+] Description : The forms Price From, Price To, Inventory greater than, and some others in the "Advanced Search" are vulnerable to SQL Injection allowing an attacker to review or execute commands in the local Database (according to the web server's configuration) [+] PoC : It's posible to check if the app is vulnerable by trying something like: 100000000 or 1=2 on the "Price From" form, as the second part of the injection is never true, the app won't show any results; although if the injection is crafted as 100000000 or 1=1, the app will show every product on its database.