OSVDB ID: 16283 Title: FishCart upstnt.php cartid Variable SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
FishCart has been reported to contain a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is supposedly due to the 'cartid' variable in the upstnt.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries. However, the vendor disputes this claim saying that it is nothing more than a forced SQL error, not a method for injection. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Rumored / Private Disclosure: Vendor Disputed OSVDB: Web Related, Myth/Fake |
Solution |
Despite the vendor not being able to reproduce the described vulnerability, they have released a patch to further enhance security precautions to prevent possible attacks. |
Products |
|
References |
|
Credit |
|
hackerscenter.com - Personal Page