NetArt Media iBoutique 4.0 (index.php key parameter) SQL Injection Vulnerability

Overview:
---------
NetArt Media iBoutique SQL Injection Vulnerability.
 
 
Technical Description:
----------------------
An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails
to sanitise user-supplied input.
 
Input passed via the 'key' parameter to '/index.php' page is not properly
verified before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code. This may allow an
unauthenticated attacker to launch further attacks.
 
These vulnerability have been tested on NetArt Media iBoutique v4.0, Other
versions may also be affected.
 
 
Impact:
--------
Successful exploitation could allow an attacker to manipulate SQL queries by
injecting arbitrary SQL code.
 
 
Affected Software:
------------------
NetArt Media iBoutique v4.0
 
 
Tested on,
NetArt Media iBoutique v4.0
 
 
References:
-----------
http://secpod.org/blog/?p=510
http://www.netartmedia.net/iboutique
http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt
 
 
Proof of Concept:
-----------------
http://www.example.com/iboutique/index.php?mod=products&key=%27



#  0day.today [2018-04-06]  #