Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Evolve Merchant[ injection sql ]
From: tony () lynxinternet com
Date: 5 Dec 2006 09:33:38 -0000

We have fixed the (original)  viewcart.asp?zoneid  one, that was a legitimate sql injection hole.

The (other)  products.asp?pa rtno  is not a sql-injection vulnerability. However it does put up a sql error message if 
an unknown partno is passed. So the researcher would have put in an apostrophe into the partno, and seen the error 
appear and assumed it was a sql-injection hole. However the partno is actually escaped correctly, and the sql error is 
actually one step removed. 

  By Date           By Thread  

Current thread:
  • Re: Evolve Merchant[ injection sql ] tony (Dec 05)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]