Description
Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp.
References
- http://aria-security.net/advisory/WWWeb%20Cocepts.txt
- 21076 vdb-entry
- wwweb-prodtype-product-sql-injection(30261) vdb-entry
- 22895 third-party-advisory
- ADV-2006-4528 vdb-entry
- 20061113 WWWeb Cocepts SQL Injection mailing-list
- 1887 third-party-advisory