SAP Web Module OLK SQL Injection

`#################################################  
###### SAP's web module OLK: SQL Injection ######  
#################################################  
  
$ Author: salcho - [email protected]  
$ Home : CSL Labs  
$ Date : 27/06/2010  
  
$#########################################################  
  
[+] Vendor : http://www.topmanage.com.pa/  
  
[+] Product : http://www.topmanage.com.pa/products/1/  
  
[+] Version : 1.91.30  
  
[+] Dork : inurl: /olk/c_p  
  
$#######################DISCLAIMER########################  
The author does not take any responsibility for the use this   
information might be put to. All the information provided  
here is for educational purposes only. The authir is no way   
responsible for any misuse of the information.  
  
$#####################SQL INJECTION#######################  
  
[+] Affected: /olk/c_p/searchCart.asp  
  
[+] Description : The forms Price From, Price To, Inventory  
greater than, and some others in the "Advanced  
Search" are vulnerable to SQL Injection allowing  
an attacker to review or execute commands in the  
local Database (according to the web server's   
configuration)  
  
[+] PoC : It's posible to check if the app is vulnerable  
by trying something like: 100000000 or 1=2 on  
the "Price From" form, as the second part of the  
injection is never true, the app won't show any  
results; although if the injection is crafted as  
100000000 or 1=1, the app will show every product  
on its database.  
`