##############################################################################
#
# Title : NetArt Media iBoutique SQL Injection Vulnerability
# Author : Antu Sanadi SecPod Technologies (www.secpod.com)
# Vendor : http://www.netartmedia.net/
# Advisory : http://secpod.org/blog/?p=510
# : http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt
# Software : NetArt Media iBoutique Version 4.0
# Date : 29/06/2012
#
##############################################################################
SecPod ID: 1044 02/02/2012 Issue Discovered
19/06/2012 Vendor Notified
No Response from vendor
18/07/2012 Advisory Released
Class: SQL Injection Severity: High
Overview:
---------
NetArt Media iBoutique SQL Injection Vulnerability.
Technical Description:
----------------------
An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails
to sanitise user-supplied input.
Input passed via the 'key' parameter to '/index.php' page is not properly
verified before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code. This may allow an
unauthenticated attacker to launch further attacks.
These vulnerability have been tested on NetArt Media iBoutique v4.0, Other
versions may also be affected.
Impact:
--------
Successful exploitation could allow an attacker to manipulate SQL queries by
injecting arbitrary SQL code.
Affected Software:
------------------
NetArt Media iBoutique v4.0
Tested on,
NetArt Media iBoutique v4.0
References:
-----------
http://secpod.org/blog/?p=510
http://www.netartmedia.net/iboutique
http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt
Proof of Concept:
-----------------
http://www.example.com/iboutique/index.php?mod=products&key=%27
Solution:
---------
Fix not available
Risk Factor:
-------------
CVSS Score Report:
ACCESS_VECTOR = NETWORK
ACCESS_COMPLEXITY = LOW
AUTHENTICATION = NONE
CONFIDENTIALITY_IMPACT = PARTIAL
INTEGRITY_IMPACT = PARTIAL
AVAILABILITY_IMPACT = NONE
EXPLOITABILITY = PROOF_OF_CONCEPT
REMEDIATION_LEVEL = UNAVAILABLE
REPORT_CONFIDENCE = CONFIRMED
CVSS Base Score = 6.4 (High) (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Credits:
--------
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
vulnerability.
