Secunia

rsauron and P47r1ck have reported a vulnerability in RazorCommerce Shopping Cart, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "id" parameter in category_search.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Solution
Filter malicious characters and character sequences using a proxy.

Provided and/or discovered by
rsauron and P47r1ck

Changelog
Further details available in Customer Area

Original Advisory
http://packetstorm.linuxsecurity.com/0809-exploits/razorcommerce-sql.txt

Deep Links
Links available in Customer Area