vendor:
Overstock Script
by:
L0rd CrusAd3r
8,8
CVSS
HIGH
SQLi Vulnerability
89
CWE
Product Name: Overstock Script
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
Overstock Script SQL Vulnerable
Overstock script is a PHP based script that can be used to display product data from the Overstock XML data feed. The script comes complete with a default template to get you started. It completely separates PHP logic and HTML look. Code: PHP 4.0. A SQLi vulnerability exists in the storecat.php file, which can be exploited by passing malicious SQL queries through the 'store' parameter.
Mitigation:
Input validation should be used to prevent malicious SQL queries from being passed through the 'store' parameter.
