full-disclosure - Re: [HTTPCS] FreeWebshop 'Text' Remote SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEJizbY1pwrcKO-XwX4N2X4vezmOpXRhfOC6muw9VyPoEX3Frw@mail.gmail.com>
Date: Mon, 17 Sep 2012 15:30:22 +0100
From: Benji <me@...ji.com>
To: Julius Kivimäki <julius.kivimaki@...il.com>
Cc: HTTPCS <contact@...pcs.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: [HTTPCS] FreeWebshop 'Text' Remote SQL
 Injection Vulnerability

you seem surprised by the level of idiocy, are you new to this list?

On Mon, Sep 17, 2012 at 2:42 PM, Julius Kivimäki
<julius.kivimaki@...il.com> wrote:
> Did you guys seriously just send five different advisories on five different
> vulnerable parameters on one vulnerable script?
>
> 2012/9/17 HTTPCS <contact@...pcs.com>
>>
>> HTTPCS Advisory : HTTPCS100
>> Product : FreeWebshop
>> Version : 2.2.9
>> Date : 2012-09-17
>> Criticality level : Highly Critical
>> Description : A vulnerability has been discovered in FreeWebshop, which
>> can be exploited by malicious people to conduct SQL injection attacks. Input
>> passed via the 'Text' parameter to '/index.php?page=cart&action=add' is not
>> properly sanitised before being used in a SQL query. This can be exploited
>> to manipulate SQL queries by injecting arbitrary SQL code.
>> Page : /index.php?page=cart&action=add
>> Variables :
>> sub=Bestellen&prodprice=1234.56&numprod=1&prodid=1&Text=[VulnHTTPCS]
>> Type : SQLI
>> Method : POST
>> Solution :
>> References : https://www.httpcs.com/advisory/httpcs100
>> Credit : HTTPCS [Web Vulnerability Scanner]
>> _______________________________________________
>>
>> Twitter : http://twitter.com/HTTPCS_
>> Free web vulnerability scanner HTTPCS : https://www.httpcs.com/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/