Perl$hop Multiple Vulnerabilities

vendor:

Perl$hop

by:

www.shadow.net

8,8

CVSS

HIGH

Cross Site Scripting, Directory Traversal, Code Execution

79, 22, 78

CWE

Product Name: Perl$hop

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Perl$hop Multiple Vulnerabilities

Perl$hop is an e-commerce script developed by Waverider Systems. It contains multiple vulnerabilities such as Cross Site Scripting (XSS), Directory Traversal, and Code Execution. The GET variable ?thispage? is vulnerable to a directory traversal and potential code execution depending on the environment. The GET variable CUR, thispage, LANG, and most likely others contain cross site scripting vulnerabilities.

Mitigation:

Input validation should be used to prevent malicious user input from being passed to the application. Sanitize user input to prevent directory traversal and code execution. Use a web application firewall to detect and block malicious input.

Source

Exploit-DB raw data:

A while back I was playing around with Perl$hop, which if you are not
aware, is an e-commerce script developed by Waverider Systems. XSS
(Cross Site Scripting), Directory Traversal, Code Execution, and more!
Wow, that sure is a lot of vulnerabilities for one product. It would
seem as if the developers had little to no regard for web application
security. Which, were this not a free product, I might comment further
upon. As this is not the case, allow me to continue.

One of the initial vulnerabilities I noticed when viewing the source
code to a product page was the existence of a hidden input field named
ITEM_PRICE. Now we simply download the source to the page, edit the
hidden value of input field ITEM_PRICE to whatever we want, as an
example value=?0.01?, and save. Reopen and purchase the item. The
following checkout page will verify your success or lack thereof. So we
can set our own price, fun stuff!

Next we examine perlshop.cgi and notice that the script does not
properly sanitize user input. After a little variable injection we find
that the GET variable ?thispage? is vulnerable to a directory traversal
and potential code execution depending on the environment. If you were
hoping for an exploit example, here it is:

http://target/cgi-bin/perlshop.cgi?ACTION=ENTER%20SHOP&thispage=../../../../../../../../etc/passwd&ORDER_ID=%21ORDERID%21&LANG=english&CUR=dollar

And lastly, to save myself the trouble, I?ll just say that the GET
variable CUR, thispage, LANG, and most likely others contain cross site
scripting vulnerabilities. XSS vulnerabilities are not nearly as
critical as the aforementioned directory traversal and code execution
vulnerabilities though they should still be taken seriously as session
fixation attempts could allow a hacker to hijack accounts.

www.shadow.net

# milw0rm.com [2009-08-04]