bugtraq - JAHx101 - Huski retail mulitple SQL injection vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 4 Feb 2010 22:13:16 -0700
From: noreply@...tanotherhacker.com
To: bugtraq@...urityfocus.com
Subject: JAHx101 - Huski retail mulitple SQL injection vulnerabilities

--------------------------------------------------------------------------------------------
20100205 - Justanotherhacker.com : Huski retail mulitple SQL injection vulnerabilities
JAHx101 - http://www.justanotherhacker.com/advisories/JAHx101.txt
--------------------------------------------------------------------------------------------

Huski Retail
Ascet Interactive offers you a very simple and cost effective method of selling goods and services online. Ascet Interactive provides you with a catalogue targeted at your customers, whether they are retail customers or your dealer network. Imagine being able to save on printing, faxing and administration costs by making your whole product range available at anytime via the Web.
[ Taken from: http://www.ascetinteractive.com/?id=huskiretail ]


--- Vulnerability description ---
The categoryID and productID parameters used in several pages are not sufficiently sanitised, leading to SQL injection.

Type: SQL Injection
Severity: Low
Release: Responsible
CVE: None
Vendor: ASCET Interactive - http://www.ascetinteractive.com
Affected versions:
Unknown

--- Exploit URI ---
http://[target]/[path]/?_action=editProducts&categoryID=[SQLI]

http://[target]/[path]/?_action=showProducts&categoryID=[SQLI]&id=shop

http://[target]/[path]/?_action=showProductDetails&productID=[SQLI]&categoryID=1310&id=shop

http://[target]/[path]/?_action=showProductDetails&productID=22095&categoryID=[SQLI]&id=shop


--- Solution ---
Contact the vendor for a fix

--- Disclosure time line ---
05-Feb-2010 - Public disclosure
29-Jan-2010 - Vendor acknowledge vulnerability
28-Jan-2010 - Vendor notified through email