Date: 12 Oct 2004 11:34:37 +0200
From: SecuriTeam <[email protected]>
To: [email protected]Subject: [UNIX] CubeCart SQL Injection Vulnerability
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
CubeCart SQL Injection Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.cubecart.com>; CubeCart is "an eCommerce script written with
PHP & MySQL. With CubeCart you can setup a powerful online store as long
as you have hosting supporting PHP and one MySQL database".
An SQL injection vulnerability has been found in the CubeCart eCommerce
product, allowing a remote attacker to insert arbitrary SQL statements
into those used by the product.
DETAILS
Vulnerable Systems:
* CubeCart version 2.0.1
Due to lack of sanitation on the behalf of the cat_id parameter, an
attacker can issue such a request as:
http://example.com/store/index.php?cat_id=1 or 1=1-- which in turn will
display all available categories in the database.
In addition, a remote user can cause an error in index.php using the
parameter 'cat_id' which will display the software's full installation
path. Accessing such a URL as http://example.com/store/index.php?cat_id='
will cause an error of the sorts of:
"Warning: mysql_fetch_array(): supplied argument is not a valid MySQL
result resource in /home/example/public_html/store/link_navi.php on line
35
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result
resource in /home/example/public_html/store/index.php on line 170
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL
result resource in /home/example/public_html/store/index.php on line 172"
ADDITIONAL INFORMATION
The information has been provided by <mailto:[email protected]> Pedro
Sanches.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
