by r0t,der4444,cembo,VietMafia

Friday, December 16, 2005

iHTML Merchant Mall SQL inj.

iHTML Merchant Mall SQL inj.

Vuln. discovered by : r0t
Date: 16 dec. 2005
vendor:http://www.ihtmlmerchant.com/features_mall.htm
affected version: latest

Product Description:

The iHTML Merchant Mall is specifically designed for Internet Service Providers and Application Service Providers that are implementing a large number of stores. With a powerful web-based store management area, you can add a new store in seconds. A new hosting customer can even create and setup her own storefront on her own. The Mall allows for an unlimited number of stores to be setup on a single server. The individual stores in the Mall have the same feature set as the iHTML Merchant 2.0 Enterprise edition. Stores can become part of a portal-like store directory, or can be independent with their own domain name. When creating a new store, a mall manager can set up billing options and define the feature set that will be available to the store owner. Preset billing plans can also be created to provide for even faster creation of stores. Stores can be automatically billed their hosting fees, thus automating much of your client management process.
The Mall edition can also be used by manufacturers to provide pre-populated stores for their resellers, by companies that want to provide a portal for buyers and sellers in a particular industry to gather and place orders plus many more applications that are outside of how you might think of a shopping mall.



Vuln. Description:

iHTML Merchant Mall contains a flaw that allows a remote sql injection attacks.Input passed to the "id" "store" "step" parameters isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code

example:

/browse.ihtml?step=4&store=42&id=[SQL]
/browse.ihtml?step=4&store=1[SQL]
/browse.ihtml?step=[SQL]

Solution:
Edit the source code to ensure that input is properly sanitised.

4 Comments:

Anonymous Anonymous told...

Hi there ##name##.

2:18 AM

 
Anonymous Ivy told...


online mall Over 10,000 of the Best Internet Resource. online mall

Business to Business -
Education -
Industrial -
Management -
Promotion -
Publishing -
Reports -
Web Design

Computing & Internet -
Banner Design -
Browsers -
Domains -
Email Services -
Graphics -
Network Administration -
Programming -
Site Design -
Screensavers -
Web Hosting

Health & Fitness -
Addiction -
Alternative -
Beauty -
Cooking & Recipes -
Diet -
Fitness -
Medicine -
Mental Health -
Nutrition -
Remedies -
Spiritual Health -
Womens Health

Home & Family -
Cooking & Recipes -
Crafts -
Family Tree -
Garden -
Home Improvement -
Kids -
Marriage -
Parenting -
Pets -
Real Estate -
Students & School

Fun & Entertainment -
Astrology -
Games -
Hobbies -
Humor -
Magic -
Music -
Novels & eBooks -
Psychics -
Screensavers -
Tarot

Marketing & Ads -
Banners -
Consulting -
Classifieds -
Ezines -
How To's -
Promotion -
Resources -
Submitters

Money & Employment -
Debt -
Education -
Entrepreneur -
Finance -
Home Business -
Investment -
Jobs -
Management -
Real Estate -
Resume -
Self Employment

Society & Culture -
Charity -
Fine Arts -
Investigation -
Language -
Law Enforcement -
Love & Romance -
Philosophy & Religion -
Politics & Government -
Science -
Shopping -
Travel

Sports & Recreation -
Autos -
Casino -
Extreme -
Golf -
Horseracing -
Outdoor -
Sports-picks -
Team Sports -
Training

1:37 AM

 
Anonymous business opportunity home based work from told...

I found your blog while surfing and noticed you are involved in a business opportunity.

I found a website the other day that offers thousands of dollars in free business building tools that might help you build your business.

Find FREE - 60,000 email leads, AutoResponder, Promo Page, Your listing in a hundreds of world directories, Your best ad on 12 Million FFAs, Self-Replicating Search Engine Program, Auto Hits Machine, eZine Success, & more!.

I'm making over $500 a day with these FREE Business Building Tools promoting my business and you can do the same promoting your business.

1:54 PM

 
Blogger Den told...

Blogs are relatively new and entrepreneurs and corporations alike are just now starting to experiment with using them .
Very informative blog site Blogger.

I have a Music site. It pretty much covers Music related stuff.

Come and check it out if you get time.

2:27 AM

 

Post a Comment

<< Home

 
Copyright (c) 2006 Pridels Sec Crew