Cr@zy_King has discovered a vulnerability in the ZoGo-Shop plugin for e107, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "cat" parameter in products.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is confirmed in version 1.15.5. Other versions may also be affected.

Solution
Update to version 1.16 build 14.

Provided and/or discovered by
Cr@zy_King

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/5605

Deep Links
Links available in Customer Area