|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: Evolve Merchant[ injection sql ]
tony
lynxinternet.com
Date: Tue Dec 05 2006 - 03:33:38 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
We have fixed the (original) viewcart.asp?zoneid one, that was a legitimate sql injection hole.
The (other) products.asp?pa rtno is not a sql-injection vulnerability. However it does put up a sql error message if an unknown partno is passed. So the researcher would have put in an apostrophe into the partno, and seen the error appear and assumed it was a sql-injection hole. However the partno is actually escaped correctly, and the sql error is actually one step removed.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]