|
|
Info |
Last Modified |
| 5 months ago |
|
|
|
|
Description |
FishCart has been reported to contain a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is supposedly due to the 'cartid' variable in the upstnt.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries. However, the vendor disputes this claim saying that it is nothing more than a forced SQL error, not a method for injection.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Rumored / Private
Disclosure:
Vendor Disputed
OSVDB:
Web Related,
Myth/Fake
|
|
Solution |
Despite the vendor not being able to reproduce the described vulnerability, they have released a patch to further enhance security precautions to prevent possible attacks.
|
|
Products |
|
FishCart
 |
3.1 |
|
|
|
|
|
Credit |
- Diabolic Crab - dcrab
 hackerscenter.com - Personal Page
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
