|
|
Family: CGI abuses --> Category: infos
DUpaypal Pro Multiple SQL Injection Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for multiple SQL injection vulnerabilities in DUpaypal Pro
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains an ASP application that is vulnerable
to multiple SQL injection attacks.
Description :
The remote host is running DUpaypal Pro, an ASP-based storefront from
DUware for Paypal.
The installed version of DUpaypal Pro fails to properly sanitize user-
supplied input in several instances before using it in SQL queries.
By exploiting these flaws, a possible hacker can affect database queries,
possibly disclosing sensitive data and launching attacks against the
underlying database.
See also :
http://echo.or.id/adv/adv19-theday-2005.txt
http://archives.neohapsis.com/archives/bugtraq/2005-06/0172.html
Solution :
Unknown at this time.
Threat Level:
High / CVSS Base Score : 7.0
(AV:R/AC:L/Au:NR/C:P/I:P/A:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
