Multiple vulnerabilities in SHOP A LA CART

vendor:

SHOP A LA CART

by:

Ariko-Security

N/A

CVSS

N/A

multiple SQL injections, multiple XSS, multiple iFrame injections, multiple link injections

N/A

CWE

Product Name: SHOP A LA CART

Affected Version From: ALL

Affected Version To: ALL

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: ALL

2010

Multiple vulnerabilities in SHOP A LA CART

Input passed via the 'xGrp' parameter to catgrp.php is not properly sanitised before being used in a SQL query. Input passed via the 'xCat' parameter to catmain.php and prodmain.php is not properly sanitised before being used in a SQL query. Input passed to the 'nLoginUser', 'nCustPhone' parameters in account_signup.php is not properly sanitised before being returned to the user. Input passed to the 'nReferrer', 'Zipcode' parameters in cart.php is not properly sanitised before being returned to the user. Input passed to the 'nPhone', 'nMailName', 'nFullName', 'nEmail', 'nComments' parameters in popup_contact.php is not properly sanitised before being returned to the user. Input passed to the 'nEmail' parameter in process_email.php is not properly sanitised before being returned to the user. Input passed to the 'xRef' parameter in customer_login.php is not properly sanitised before being returned to the user. Input passed to the 'xProd', 'xCat' parameter in prodmain.php is not properly sanitised before being returned to the user. Input passed to the 'nSearch' parameter in search.php is not properly sanitised before being returned to the user.

Mitigation:

Input validation of all vulnerable parameters should be corrected.

Source

Exploit-DB raw data:

  # Exploit Title: [Multiple vulnerabilities in SHOP A LA CART]
# Date: [03.09.2010]
# Author: [Ariko-Security]
# Software Link: [http://shopalacart.com]
# Version: [ALL]
# Tested on: [ALL]
# CVE : [n/a]

# Ariko-Security: Security Audits , Audyt bezpieczeństwa
# Advisory: 728/2010

============ { Ariko-Security - Advisory #1/9/2010 } =============

Multiple vulnerabilities in SHOP A LA CART

Vendor's Description of Software:
# http://shopalacart.com/shopping_cart_demo.php

Dork:
# N/A

Application Info:
# Name: SHOP A LA CART
# ALL versions

Vulnerability Info:
# Type: multiple SQL injections, multiple XSS, multiple iFrame 
injections, multiple link injections,

Time Table:
# 20/08/2010 - Vendor notified.

Fix:
# n/a

Input passed via the "xGrp" parameter to catgrp.php is not properly
sanitised before being used in a SQL query.
Input passed via the "xCat"  parameter to catmain.php and prodmain.php 
is not properly
sanitised before being used in a SQL query.


Input passed to the "nLoginUser" ,"nCustPhone" parameters in 
account_signup.php is not properly
sanitised before being returned to the user.

Input passed to the "nReferrer" ,"Zipcode" parameters in cart.php is not 
properly
sanitised before being returned to the user.

Input passed to the "nPhone" ,"nMailName", "nFullName", "nEmail", 
"nComments" parameters in popup_contact.php
is not properly sanitised before being returned to the user.

Input passed to the "nEmail" parameter in process_email.php
is not properly sanitised before being returned to the user.


Input passed to the "xRef" parameter in customer_login.php
is not properly sanitised before being returned to the user.


Input passed to the "xProd", "xCat" parameter in prodmain.php
is not properly sanitised before being returned to the user.

Input passed to the "nSearch" parameter in search.php
is not properly sanitised before being returned to the user.


Solution:
# Input validation of all vulnerable parameters should be corrected.

Vulnerability samples:
# http://[site]/cart.php?nReferrer=';</script><script>alert(XSS)</script>
# http://[site]/catgrp.php?xGrp=[SQLi]
# http://[site]/account_signup.php [POST] 
nUpdate=1&nCustName=&nCustEmail=test%40altoromutual.com&nEmailOptOut=1&nCustPhone=%22%27%3E%3CA+HREF

%3D%22%2AAriko-Security.html%22%3EInjection%3C%2FA%3E&nLoginUser=&nLoginPass=&.x=0&.y=0

Credit:
# Discoverd By:  Ariko-Security 2010
# Advisory: 
http://advisories.ariko-security.com/september/audyt_bezpieczenstwa_729.html 


-- 
Ariko-Secuirty