vendor:
Bigware Shop
by:
D4m14n
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Bigware Shop
Affected Version From: 2
Affected Version To: 2
Patch Exists: NO
Related CWE: N/A
CPE: a:bigware:bigware_shop
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Bigware Shop 2.0
There is a SQL Injection vulnerability in the main_bigware_53.tpl.php file of Bigware Shop 2.0. An attacker can exploit this vulnerability by sending a crafted HTTP request with a malicious pollid parameter. This will allow the attacker to view the admin's email address and salted password hash.
Mitigation:
Input validation should be used to prevent SQL Injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query.
