NetArt Media iBoutique 4.0 SQL Injection

`##############################################################################  
#  
# Title : NetArt Media iBoutique SQL Injection Vulnerability  
# Author : Antu Sanadi SecPod Technologies (www.secpod.com)  
# Vendor : http://www.netartmedia.net/  
# Advisory : http://secpod.org/blog/?p=510  
# : http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt  
# Software : NetArt Media iBoutique Version 4.0  
# Date : 29/06/2012  
#  
##############################################################################  
  
SecPod ID: 1044 02/02/2012 Issue Discovered  
19/06/2012 Vendor Notified  
No Response from vendor  
18/07/2012 Advisory Released  
  
Class: SQL Injection Severity: High  
  
  
Overview:  
---------  
NetArt Media iBoutique SQL Injection Vulnerability.  
  
  
Technical Description:  
----------------------  
An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails  
to sanitise user-supplied input.  
  
Input passed via the 'key' parameter to '/index.php' page is not properly  
verified before being used in a SQL query. This can be exploited to  
manipulate SQL queries by injecting arbitrary SQL code. This may allow an  
unauthenticated attacker to launch further attacks.  
  
These vulnerability have been tested on NetArt Media iBoutique v4.0, Other  
versions may also be affected.  
  
  
Impact:  
--------  
Successful exploitation could allow an attacker to manipulate SQL queries by  
injecting arbitrary SQL code.  
  
  
Affected Software:  
------------------  
NetArt Media iBoutique v4.0  
  
  
Tested on,  
NetArt Media iBoutique v4.0  
  
  
References:  
-----------  
http://secpod.org/blog/?p=510  
http://www.netartmedia.net/iboutique  
http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt  
  
  
Proof of Concept:  
-----------------  
http://www.example.com/iboutique/index.php?mod=products&key=%27  
  
  
Solution:  
---------  
Fix not available  
  
  
Risk Factor:  
-------------  
CVSS Score Report:  
ACCESS_VECTOR = NETWORK  
ACCESS_COMPLEXITY = LOW  
AUTHENTICATION = NONE  
CONFIDENTIALITY_IMPACT = PARTIAL  
INTEGRITY_IMPACT = PARTIAL  
AVAILABILITY_IMPACT = NONE  
EXPLOITABILITY = PROOF_OF_CONCEPT  
REMEDIATION_LEVEL = UNAVAILABLE  
REPORT_CONFIDENCE = CONFIRMED  
CVSS Base Score = 6.4 (High) (AV:N/AC:L/Au:N/C:N/I:P/A:N)  
  
Credits:  
--------  
Antu Sanadi of SecPod Technologies has been credited with the discovery of this  
vulnerability.  
  
`