Injection attack vulnerability in browse.asp

VERSIONS AFFECTED

Q-Shop Pro and Lite v3.5.0 and 3.5.1.

DETAILS

It would be possible to provide a link to a Q-Shop store and make it display customer data using the OrderBy field.

RESOLUTION

Follow this simple steps:

1. Edit browse.asp and where it says:

Dim OrderBy, QryOrderBy, sqlOrderBy
'Read value from Query String
OrderBy = Request("OrderBy")

Change it to:

Dim OrderBy, QryOrderBy, sqlOrderBy
'Read value from Query String
OrderBy = Request("OrderBy")

If NOT (OrderBy = "Name" OR OrderBy = "Price") Then OrderBy = ""