Info

Disclosure

Jan 26, 2004

Discovery

Jan 26, 2004

Dates

Exploit

Unknown

Solution

Unknown

Description

Quadcomm Q-Shop contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that user input in the cart.asp module is not verified properly and will allow an attacker to inject or manipulate SQL queries.

Classification

Location: Remote/Network Access Required
Attack Type: Authentication Management, Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Quadcomm	Q-Shop	1.x
		2.0
		2.1
		2.2
		2.3
		2.4
		2.5

References

Secunia Advisory ID: 10704
ISS X-Force ID: 14922
CVE ID: 2004-2108 (see also: NVD)
Bugtraq ID: 9481
Other Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2004-01/0227
Vendor URL: http://quadcomm.com/qshop/

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218