I have been informed by a colleague who has looked into this that the specific problem that was causing the MySQL type of errors to occur can be addressed with a code update to the page.
On the products results page update the code that is on lines 75-91
from this:
php:
<?php
if ( isset($_GET["Search"])) {
$_SESSION["WADbSearch1_Products_Cat"]="";
if (isset($_GET["ProductCategoryID"])) {
if ($WADbSearch1->whereClause != "") {
$WADbSearch1->whereClause .= " AND ";
} else {
$WADbSearch1->whereClause .= " WHERE ";
}
$WADbSearch1->whereClause .= "ProductID IN (SELECT ProductID FROM ps3_productcategories WHERE (CategoryID = ".implode($_GET["ProductCategoryID"]," OR CategoryID = ")."))";
$_SESSION["WADbSearch1_Products_Results"]=$WADbSearch1->whereClause;
if (sizeof($_GET["ProductCategoryID"]) == 1) {
$_SESSION["WADbSearch1_Products_Cat"]=$_GET["ProductCategoryID"][0];
}
}
}
?>
to this
php:
<?php
if ( isset($_GET["Search"])) {
$_SESSION["WADbSearch1_Products_Cat"]="";
if (isset($_GET["ProductCategoryID"])) {
if ($WADbSearch1->whereClause != "") {
$WADbSearch1->whereClause .= " AND ";
} else {
$WADbSearch1->whereClause .= " WHERE ";
}
for ($x=0; $x<sizeof($_GET["ProductCategoryID"]); $x++) {
$_GET["ProductCategoryID"][$x] = intval($_GET["ProductCategoryID"][$x]);
}
$WADbSearch1->whereClause .= "ProductID IN (SELECT ProductID FROM ps3_productcategories WHERE (CategoryID = ".implode($_GET["ProductCategoryID"]," OR CategoryID = ")."))";
$_SESSION["WADbSearch1_Products_Results"]=$WADbSearch1->whereClause;
if (sizeof($_GET["ProductCategoryID"]) == 1) {
$_SESSION["WADbSearch1_Products_Cat"]=$_GET["ProductCategoryID"][0];
}
}
}
?>
Please give this a try on your products results page then run this check again to see if you get any more vulnerabilities. If you do please post back with the info for them.
