Description
Multiple SQL injection vulnerabilities in cgi-bin/reorder2.asp in SalesCart Shopping Cart allow remote attackers to execute arbitrary SQL commands via the password field and other unspecified vectors. NOTE: the vendor disputes this issue, stating "We were able to reproduce this sql injection on an old out-of-date demo on the website but not on the released product.
References
- 24226 vdb-entry
- salesacart-reorder2-sql-injection(34567) vdb-entry
- 20070613 Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability mailing-list
- 2758 third-party-advisory
- 40145 vdb-entry
- 20070529 RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability mailing-list
- 20070614 Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability mailing-list