CoreCommerce SQL injection Vulnerability

# Exploit Title : CoreCommerce SQL injection
# Date : 22/03/2012
# Author : ZeTH
# Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com
# Vendor : http://www.corecommerce.com
# Version : 3.0
# d0rk : intext:"Powered by Core-Commerce"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
--[1]-- Introduction
CoreCommerce is the full-service shopping cart solution that makes it
easy for you to sell online. Choose from over 250+ hand-crafted,
professionally made themes for your store to get that look that's just
right.
 
--[2]-- Vulnerability
File : index.php
Attack Method : remote SQL injection
POC : http://site/catalogue/index.php?id=SQLi
 
--[3]-- Greetz
MainHack Brotherhood, Kecoak Elektronik, Echo
Paman, Vrs-hCk, OoN_BoY, em|nem, [S]hiro, Martin, xshadow, ElDiablo,
Furkan, Pizzyroot, H312Y



#  0day.today [2018-01-05]  #