acartSQL.txt

`#Title: A-CART Pro & A-CART 2.0 Input Validation Holes   
  
#Software: A-CART Pro & A-CART 2.0  
#Vendor: http://www.alanward.net  
#Underlying OS: Windows.   
  
#Description:   
  
A-CART is an ASP shopping cart application written in VBScript. The system   
allows a customer to browse through an inventory of products and add these   
items to their virtual shopping cart. Features include hierarchial   
categories, featured product, custom attributes and user profiles.   
  
#Vulnerabilities:   
  
A-CART input validation holes let remote users inject SQL and conduct   
Cross-Site Scripting attacks.   
  
#SQL Injection#   
  
An Sql injection vulnerability allows a remote attacker to execute malicious   
SQL statements on the database to gain Administrator access.   
  
/category.asp?catcode=[SqlInjection]   
  
#-Exploit-#   
  
http://host/category.asp?catcode=1%20union%20all%20select%20pass,0,0,0,0%20f   
rom%20customers%20where%20fname='[Username]'   
  
#Cross-Site Scripting#   
  
This product is vulnerable to the Cross-Site Scripting vulnerability that   
would allow attackers to inject HTML and script codes into the pages and   
execute it on the client's browser.  
The vulnerability exists on the user information forms in deliver.asp,   
billing.asp.   
  
#Solution:   
  
No solution was available at the time of this entry. Vendor contacted three   
times and three unanswered mails.   
  
#Credits:   
  
Manuel López. [email protected]  
`