[29711] in bugtraq
[ARL03-A16] Multiple Security Issues in phPay
daemon@ATHENA.MIT.EDU (Ahmet Sabri ALPER)
Thu Apr 10 00:08:54 2003
Date: 9 Apr 2003 08:03:53 -0000
Message-ID: <20030409080353.29012.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Ahmet Sabri ALPER <s_alper@hotmail.com>
To: bugtraq@securityfocus.com
+/--------\-------- ALPER Research Labs ------/--------/+
+/---------\------- Security Advisory -----/---------/+
+/----------\------ ID: ARL03-A16 ----/----------/+
+/-----------\----- salper@olympos.org ---/-----------/+
Advisory Information
--------------------
Name : Multiple Security Issues in phPay
Software Package : phPay
Vendor Homepage : http://phpay.sourceforge.net/
Vulnerable Versions: v2.02 and possibly older versions
Platforms : OS Independent, PHP & MySQL
Vulnerability Type : Input Validation Error
Vendor Contacted : 20/02/2003
Vendor Replied : 20/02/2003
Prior Problems : N/A
Current Version : v2.02.1 (problem fixed)
Summary
-------
phPay is an ecommerce, webshop and catalogue system for PHP4 &MySQL.
It supports several languages and includes many functions for an online
shopping area.
Multiple path disclosure, information leakage and a Cross Site Scripting
problem exist within "phPay v2.02".
Details
-------
1. Cross Site Scripting vulnerability in search.php
Example:
http://[TARGET]/search.php?sess=your_session_id&lookfor=<script>alert
(document.cookie)</script>
2. Path disclosure vulnerability, when a non-existent language is selected.
Example:
http://[TARGET]/login.php?
sess=your_session_id&abt=&new_lang=99999&caller=navlang
Output:
>Fatal error: Failed opening required 'lang/.inc.php'
>(include_path='.:/usr/share/php') in /home/web/html/phpay/lib.inc.php on
>line 10
3. Path disclosure in start.php when pointing to a non existent file, this
might also
allow inclusion of arbitrary remote files.
Example:
http://[TARGET]/start.php?config=alper.inc.php
Output:
>Fatal error: Failed opening required './alper.inc.php'
>(include_path='.:/usr/share/php') in /home/web/html/phpay/start.php on
>line 17
4. You may stop by and watch the phpinfo(); for the site in
/admin/phpinfo.php
5. Path disclosure in /doc/addon-index.php (because of an extra ../ in the
include path).
6. Several other path disclosure vulnerabilities when scripts and include
files are directly called.
Examples:
detail.php, fpass.php, header.inc.php, main.php, nav.php, pay.php,
payed.php, publicpay.inc.php, reguser.php, search.php, server.php,
view_cart.php, lib.inc.php, show_size.inc.php, limit.navi.inc.php,
mailer.inc.php, show_cart.inc.php, stats.php, show_color.inc.php,
show_content.inc.php, show_item_0.inc.php, show_item_1.inc.php,
show_item_x.inc.php, show_item_2.inc.php
7. Some more path disclosure vulnerabilities in the "admin" directory.
Solution
--------
A new version which addresses the listed vulnerabilities has been
released. Downloadable from;
http://sourceforge.net/projects/phpay
Credits
-------
Discovered on 20, February, 2003 by
Ahmet Sabri ALPER <salper@olympos.org>
ALPER Research Labs.
The ALPER Research Labs. [ARL] workers are freelancer
security professionals and WhiteHat hackers. The ARL
workers are available for hiring for legal jobs.
The ARL also supports Open Software Community, by detecting
possible security issues in GPL or any other Public Licensed
product.
References
----------
Product Web Page: http://phpay.sourceforge.net/
Olympos: http://www.olympos.org/
