[28406] in bugtraq
a.shopKart Shopping Cart remote vulnerabilities
daemon@ATHENA.MIT.EDU (Ignacio Vazquez)
Wed Jan 8 15:27:07 2003
Date: Wed, 8 Jan 2003 13:02:39 -0300
From: Ignacio Vazquez <infosecmanager@centaura.com.ar>
To: bugtraq@securityfocus.com
Message-ID: <20030108160239.GA26543@mainframe.centaura.com.ar>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Centaura Technologies Security Research Lab Advisory
Product Name: a.shopKart Web Shopping Cart
Systems: Windows NT/2000/.NET Server
Severity: High Risk
Remote: Yes
Category: Insuficient input checking
Vendor URL: http://www.urlogy.com
Advisory Author: Ignacio Vazquez
Advisory URL: http://www.centaura.com.ar/infosec/adv/ashopkart.txt
Revised-Date: January 9, 2003
Advisory Code: CTADVIIC046
.:Introduction
a.shopKart is a free shopping cart developed in ASP.
Its features include product updating, customer management, etc
.: Impact
An attacker can access sensitive information within the system
database.
This can lead to sensitive personal information disclosure, including
but not limiting to credit card information, address and telephone
numbers.
.: Description
The program is vulnerable in several spots along the code.
There's a basic input checking function ( TwoSingleQ(str) ) but
it's not applied everywhere, leaving potencial exploitable holes.
The following statement shows the vulnerable points
(taken from addcustomer.asp).
Here "zip", "state", "country", "phone" and "fax" are unchecked for
SQL Injection vulnerabilities.
sqlAdd = "INSERT INTO customers(cfirstname,clastname,cemail,caddress"
If Request.Form("address2") <> "" Then
sqlAdd = sqlAdd & ",caddress2"
end if
sqlAdd = sqlAdd & ",ctown,czip"
If Request.Form("state") <> "" Then
sqlAdd = sqlAdd & ",cstate"
End if
sqlAdd = sqlAdd & ",ccountry,cphone"
If Request.Form("fax") <> "" Then
sqlAdd = sqlAdd & ",cfax"
End if
sqlAdd = sqlAdd & ") VALUES("
sqlAdd = sqlAdd & "'" & TwoSingleQ(fname) & "'"
sqlAdd = sqlAdd & ",'" & TwoSingleQ(lname) & "'"
sqlAdd = sqlAdd & ",'" & TwoSingleQ(email) & "'"
sqlAdd = sqlAdd & ",'" & TwoSingleQ(address) & "'"
If Request.Form("address2") <> "" Then
sqlAdd = sqlAdd & ",'" & TwoSingleQ(Request.Form("address2")) & "'"
end if
sqlAdd = sqlAdd & ",'" & TwoSingleQ(town) & "'"
sqlAdd = sqlAdd & ",'" & zip & "'"
If Request.Form("state") <> "" Then
sqlAdd = sqlAdd & ",'" & Request.Form("state") & "'"
End if
sqlAdd = sqlAdd & ",'" & country & "'"
sqlAdd = sqlAdd & ",'" & phone & "'"
If Request.Form("fax") <> "" Then
sqlAdd = sqlAdd & ",'" & Request.Form("fax") & "'"
End If
sqlAdd = sqlAdd & ")"
At least addcustomer.asp, addprod.asp, process.asp are vulnerable to
this type of attacks.
.: Official Fix Information
The vendor has been contacted but no fix has been released yet.
-----
Ignacio Vazquez
<ivazquez@centaura.com.ar>
Director of Technology
Security Labs Manager
Centaura Technologies
http://www.centaura.com.ar
