a.shopKart Shopping Cart remote vulnerabilities

• Previous message: SGI Security Coordinator: "Netscape Browsers Vulnerabilities on IRIX"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Wed, 8 Jan 2003 13:02:39 -0300
From: Ignacio Vazquez <infosecmanager@centaura.com.ar>
To: bugtraq@securityfocus.com

Centaura Technologies Security Research Lab Advisory

Product Name: a.shopKart Web Shopping Cart
Systems: Windows NT/2000/.NET Server
Severity: High Risk
Remote: Yes
Category: Insuficient input checking
Vendor URL: http://www.urlogy.com
Advisory Author: Ignacio Vazquez
Advisory URL: http://www.centaura.com.ar/infosec/adv/ashopkart.txt
Revised-Date: January 9, 2003
Advisory Code: CTADVIIC046

.:Introduction

a.shopKart is a free shopping cart developed in ASP.
Its features include product updating, customer management, etc

.: Impact
An attacker can access sensitive information within the system
database.

This can lead to sensitive personal information disclosure, including
but not limiting to credit card information, address and telephone
numbers.

.: Description
The program is vulnerable in several spots along the code.
There's a basic input checking function ( TwoSingleQ(str) ) but
it's not applied everywhere, leaving potencial exploitable holes.

The following statement shows the vulnerable points
(taken from addcustomer.asp).

Here "zip", "state", "country", "phone" and "fax" are unchecked for
SQL Injection vulnerabilities.

sqlAdd = "INSERT INTO customers(cfirstname,clastname,cemail,caddress"
        If Request.Form("address2") <> "" Then
                sqlAdd = sqlAdd & ",caddress2"
        end if
        sqlAdd = sqlAdd & ",ctown,czip"
        If Request.Form("state") <> "" Then
                sqlAdd = sqlAdd & ",cstate"
        End if
        sqlAdd = sqlAdd & ",ccountry,cphone"
        If Request.Form("fax") <> "" Then
                sqlAdd = sqlAdd & ",cfax"
        End if
        sqlAdd = sqlAdd & ") VALUES("
        sqlAdd = sqlAdd & "'" & TwoSingleQ(fname) & "'"
        sqlAdd = sqlAdd & ",'" & TwoSingleQ(lname) & "'"
        sqlAdd = sqlAdd & ",'" & TwoSingleQ(email) & "'"
        sqlAdd = sqlAdd & ",'" & TwoSingleQ(address) & "'"
        If Request.Form("address2") <> "" Then
        sqlAdd = sqlAdd & ",'" & TwoSingleQ(Request.Form("address2")) & "'"
        end if
        sqlAdd = sqlAdd & ",'" & TwoSingleQ(town) & "'"
        sqlAdd = sqlAdd & ",'" & zip & "'"
        If Request.Form("state") <> "" Then
                sqlAdd = sqlAdd & ",'" & Request.Form("state") & "'"
        End if
        sqlAdd = sqlAdd & ",'" & country & "'"
        sqlAdd = sqlAdd & ",'" & phone & "'"
        If Request.Form("fax") <> "" Then
                sqlAdd = sqlAdd & ",'" & Request.Form("fax") & "'"
        End If
        sqlAdd = sqlAdd & ")"
        
At least addcustomer.asp, addprod.asp, process.asp are vulnerable to
this type of attacks.

.: Official Fix Information

The vendor has been contacted but no fix has been released yet.

-----

Ignacio Vazquez
<ivazquez@centaura.com.ar>

Director of Technology
Security Labs Manager

Centaura Technologies
http://www.centaura.com.ar

• Next message: Andrew: "Re[2]: Opentype font file causes Windows to restart."
• Previous message: SGI Security Coordinator: "Netscape Browsers Vulnerabilities on IRIX"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]