[UNIX] CubeCart SQL Injection Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 10/12/04

  • Next message: SecuriTeam: "[NT] Vulnerability in RPC Runtime Library Allows Information Disclosure and DoS (MS04-029)" 
    To: list@securiteam.com
Date: 12 Oct 2004 11:34:37 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      CubeCart SQL Injection Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.cubecart.com> CubeCart is "an eCommerce script written with
    PHP & MySQL. With CubeCart you can setup a powerful online store as long
    as you have hosting supporting PHP and one MySQL database".

    An SQL injection vulnerability has been found in the CubeCart eCommerce
    product, allowing a remote attacker to insert arbitrary SQL statements
    into those used by the product.

    DETAILS

    Vulnerable Systems:
     * CubeCart version 2.0.1

    Due to lack of sanitation on the behalf of the cat_id parameter, an
    attacker can issue such a request as:
    http://example.com/store/index.php?cat_id=1 or 1=1-- which in turn will
    display all available categories in the database.

    In addition, a remote user can cause an error in index.php using the
    parameter 'cat_id' which will display the software's full installation
    path. Accessing such a URL as http://example.com/store/index.php?cat_id='
    will cause an error of the sorts of:

    "Warning: mysql_fetch_array(): supplied argument is not a valid MySQL
    result resource in /home/example/public_html/store/link_navi.php on line
    35

    Warning: mysql_num_rows(): supplied argument is not a valid MySQL result
    resource in /home/example/public_html/store/index.php on line 170

    Warning: mysql_fetch_array(): supplied argument is not a valid MySQL
    result resource in /home/example/public_html/store/index.php on line 172"

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:pedro_sanches@sapo.pt> Pedro
    Sanches.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Vulnerability in RPC Runtime Library Allows Information Disclosure and DoS (MS04-029)"

    Relevant Pages