OSVDB ID: 3973 Title: Online Store Kit more.php id Parameter SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
Online Store Kit contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the "id" variable in the more.php module is not verified properly and will allow an attacker to inject or manipulate SQL queries. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
|
References |
|
Credit |
|
systemsecure.org -