Description
Multiple SQL injection vulnerabilities in (1) addcustomer.asp, (2) addprod.asp, and (3) process.asp in a.shopKart 2.0.3 allow remote attackers to execute arbitrary SQL and obtain sensitive information via the zip, state, country, phone, and fax parameters.
References
- ashopkart-multiple-sql-injection(11029) vdb-entry
- 6558 vdb-entry
- 37036 vdb-entry
- 37038 vdb-entry
- 37037 vdb-entry
- 20030108 a.shopKart Shopping Cart remote vulnerabilities mailing-list
- http://www.centaura.com.ar/infosec/adv/ashopkart.txt
- 7838 third-party-advisory
- 1005903 vdb-entry