A+ Store E-Commerce browse.asp SQL injection
| a+store-browse-sql-injection (30283) |  Medium Risk |
Description:
A+ Store E-Commerce is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the browse.asp script using the ParentID parameter, which could allow the attacker to view, add, modify or delete information in the back-end database.
Platforms Affected:
- Microsoft, Windows 2000 Server
- Webinhabit, A+ Store E-Commerce
Remedy:
No remedy available as of November 29, 2008.
Consequences:
Data Manipulation
References:
- A+ Store E-Commerce Web site, A+ Store E-Commerce at http://webinhabit.com/apstore/.
- BugTraq Mailing List, Tue Nov 14 2006 - 14:45:11 CST , A+ Store E-Commerce[ injection sql & xss (post) ] at http://archives.neohapsis.com/archives/bugtraq/2006-11/0248.html.
- BID-21092: Web Inhabit A+ Store E-Commerce Input Validation Vulnerabilities
- CVE-2006-5959: SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter.
- OSVDB ID: 30417: A+ Store E-Commerce browse.asp ParentID Variable SQL Injection
- SA22918: A+ Store E-Commerce SQL Injection and Cross-Site Scripting
Reported:
Nov 14, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net