QuickEStore v.7.9 SQLInjection and Path Diclosure Download Vulnerability

vendor:

QuickEStore

by:

indoushka

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: QuickEStore

Affected Version From: 7.9

Affected Version To: 7.9

Patch Exists: Unknown

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)

Unknown

QuickEStore v.7.9 SQLInjection and Path Diclosure Download Vulnerability

Input passed to the 'CategoryID' parameter in prodpage.cfm, the 'SubCatID' parameter in index.cfm, the 'OrderID' parameter in shipping.cfm, and to the 'ItemID' parameter in proddetail.cfm is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Note that error messages disclose the full installation path.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to modify the logic of the executed query.

Source

Exploit-DB raw data:

========================================================================================                  
| # Title    : QuickEStore v.7.9 SQLInjection and Path Diclosure Download Vulnerability|
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -(00213771818860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : SQL Injection                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| Vulnerability description
| Input passed to the "CategoryID" parameter in prodpage.cfm, the "SubCatID" parameter in index.cfm, the "OrderID" parameter in shipping.cfm, and to the "ItemID" parameter in proddetail.cfm is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 
|
| Note that error messages disclose the full installation path. 
|
| Examples:
|/prodpage.cfm?CFID=&CFTOKEN=&CategoryID=[SQL]
|/index.cfm?CFID=1&CFTOKEN=1&SubCatID=[SQL]
|/proddetail.cfm?CFID=1&CFTOKEN=1&ItemID=[SQL]
|/checkout.cfm?CFID=&CFTOKEN=&OrderID=[SQL]
|/shipping.cfm?CFID=&CFTOKEN=&OrderID=[SQL]
|Confirmed in version 7.9. Other versions may also be affected.
|This vulnerability affects /sm-ak051/prodpage.cfm. 
|The impact of this vulnerability:
|The remote attacker can manipulate SQL queries by injecting arbitrary SQL code.
|Attack details:
|No details .
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) 
* Stake (v4-team) * Angel25dz (hackteatch.com)
-------------------------------------------------------------------------------------------