vendor:
Prince Comparison Script Shopping card
by:
XaDoS
7.5
CVSS
HIGH
Remote SQL Injection
89
CWE
Product Name: Prince Comparison Script Shopping card
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Prince Comparison Script : Shopping card <= Rem0tE $ql Injection
A remote SQL injection vulnerability exists in the Prince Comparison Script Shopping card. An attacker can send a specially crafted HTTP request containing malicious SQL statements to the vulnerable application in order to gain access to unauthorized information or to manipulate data. The vulnerable parameter is 'subcategory_id' which can be found in the URL http://willscript.com/rjbike_new/product.php?category_id=1&subcategory_id=[$qL].
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL statements. Additionally, parameterized queries should be used to prevent SQL injection attacks.
