Description
Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via (1) the ProductID parameter in (a) reviews.asp, or the (2) cat_id or (3) sub_id parameter in (b) subProducts.asp. NOTE: the productdetail.asp vector is already covered by another identifier.
References
- 1906 third-party-advisory
- 20061114 eShopping Cart [injection sql] mailing-list
- 22955 third-party-advisory
- ADV-2006-4578 vdb-entry
- http://s-a-p.ca/index.php?page=OurAdvisories&id=21
- 21151 vdb-entry