Midicart sql injection

[crazy frog crazy frog]

Midicart sql injection
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D

product description(from site):-
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D
MidiCart is a Try-Before-You-Buy Shopping Cart Software, that provides
all you need to create, operate, and maintain a professional Internet
shop. MidiCart ASP and PHP Shopping Cart is extremely easy to use,
flexible, powerful and affordable e-commerce solution for your web
site.

details:-
=3D=3D=3D=3D=3D=3D=3D
there exists a vulnerability query string in search_list.asp
file,which is vulerable to sql injection attack.an attacker can run
any arbitary query.

How to determine:-
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D
enter following query in to search box:-
1' union select * from products'
this will list all the products.it mean the installation is vulnerable.

workaround:-
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
santinize the input supplied.it is stored in a variable named "searchstring=
".

--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
"oh yeah oh yeah...
another wannabe, in hackerland!!!"

--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
"oh yeah oh yeah...
another wannabe, in hackerland!!!"

[exoduks@securityfocus.com, [at]@securityfocus.com,]

This was reported by me 8 mounth ago!

http://www.securityfocus.com/bid/13512