*==== =={ Advisory 14/5/2010 } ======*
*SQL injection vulnerability in SelfComposer CMS
*
*Vendor's Description of Software:*
*# http://www.selfcomposer.it*
*Dork:*
*allinurl:"prodotti.asp?idpadrerif="*
*Application Info:*
*Name: *SelfComposer
*Vulnerability Info:*
*Type: *SQL injection Vulnerability
*Risk: High*
*Fix:*
*N/A*
*Time Table:*
*06/05/2010 - Vendor notified.*
*Additional Info:*
All the input passed via "idprod", "idpadrerif", "idreferenza",
"idpadrerifIstituzionali"
is not properly sanitised before being used in a sql query.
*Solution:*
Input validation of "idprod", "idpadrerif", "idreferenza",
"idpadrerifIstituzionali"
parameters should be corrected.
*Vulnerability:*
# http://[site]/scheda.asp?idprod=[SQLi]&idpadrerif=[SQLi]
# http://[site]/schedaistituzionale.asp?idreferenza=[SQLi]&idpadrerifIstituzionali=[SQLi]
*Credit:*
Discoverd By: Locu
Website: http://xlocux.wordpress.com
Contacts: xlocux[-at-]gmail.com
*============ {EOF} =============*
*
*
*Locu*
