ProductCart advSearch_h.asp script SQL injection
| productcart-advsearchhasp-sql-injection (15233) |  Medium Risk |
Description:
ProductCart is vulnerable to SQL injection, caused by a vulnerability in the advSearch_h.asp script. A remote attacker could insert arbitrary SQL code in a request to the advSearch_h.asp script, which could allow the attacker to obtain sensitive information, including customer information, and possibly add, modify or delete information in the backend database.
Consequences:
Data Manipulation
Remedy:
Download and install the latest version of ProductCart, or apply the Security Patch released on 01.30.2004 from the ProductCart Support Center. See References.
References:
- BugTraq Mailing List, Wed Feb 18 2004 - 11:27:32 CST: Re: EarlyImpact ProductCart shopping cart software multiple security vulnerabilities.
- EarlyImpact Web site: ProductCart Support Center.
- Full-Disclosure Mailing List, Mon Feb 16 2004 - 05:23:12 CST: EarlyImpact ProductCart shopping cart software multiple security vulnerabilities.
- BID-9669: EarlyImpact ProductCart Multiple Vulnerabilities
- CVE-2004-2173: SQL injection vulnerability in advSearch_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter.
- OSVDB ID: 3981: ProductCart advSearch_h.asp SQL Injection
- SA10898: ProductCart SQL Injection and Cross Site Scripting Vulnerabilities
- SECTRACK ID: 1009085: ProductCart `advSearch_h.asp` Input Validation Flaw Lets Remote Users Inject SQL to Execute Arbitrary Commands on the System
Platforms Affected:
- Early Impact ProductCart
Reported:
Feb 16, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net