Re: Evolve Merchant[ injection sql ]
We have fixed the (original) viewcart.asp?zoneid one, that was a legitimate
sql injection hole.
The (other) products.asp?pa rtno is not a sql-injection vulnerability.
However it does put up a sql error message if an unknown partno is passed. So
the researcher would have put in an apostrophe into the partno, and seen the
error appear and assumed it was a sql-injection hole. However the partno is
actually escaped correctly, and the sql error is actually one step removed.