We have fixed the (original) viewcart.asp?zoneid one, that was a legitimate
sql injection hole.
The (other) products.asp?pa rtno is not a sql-injection vulnerability.
However it does put up a sql error message if an unknown partno is passed. So
the researcher would have put in an
vendor site:http://www.lynxinternet.com/
product:Evolve Merchant
bug:injection sql
risk:medium
injection sql (get) :
http://site.com/viewcart.asp?zoneid='[sql]
laurent gaffié benjamin mossé
http://s-a-p.ca/
contact: [EMAIL PROTECTED]
