vendor:
clickcart
by:
Y3d D3v!L
7.5
CVSS
HIGH
Auth Bypass Remote SQL Injection
89
CWE
Product Name: clickcart
Affected Version From: 6
Affected Version To: 6
Patch Exists: NO
Related CWE: N/A
CPE: a:clicktech:clickcart
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Auth Bypass Remote SQL Injection Vulnerability
A vulnerability in clicktech.com's clickcart 6.0 software allows an attacker to bypass authentication and gain access to the system. The vulnerability is caused by a SQL injection in the customer_login.asp page, which allows an attacker to use the 'r0' or '1=1--' username and password combination to gain access.
Mitigation:
Ensure that user input is properly sanitized and validated before being used in SQL queries.
