Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » a.shopKart Shopping Cart remote vulnerabilities

a.shopKart Shopping Cart remote vulnerabilities

by Nikola Strahija on January 9th, 2003 An attacker can access sensitive information within the system database.


Product Name: a.shopKart Web Shopping Cart
Systems: Windows NT/2000/.NET Server
Severity: High Risk
Remote: Yes
Category: Insuficient input checking
Vendor URL: http://www.urlogy.com
Advisory Author: Ignacio Vazquez
Advisory URL: http://www.centaura.com.ar/infosec/adv/ashopkart.txt
Revised-Date: January 9, 2003
Advisory Code: CTADVIIC046


.:Introduction

a.shopKart is a free shopping cart developed in ASP.
Its features include product updating, customer management, etc

.: Impact
An attacker can access sensitive information within the system
database.

This can lead to sensitive personal information disclosure, including
but not limiting to credit card information, address and telephone
numbers.

.: Description
The program is vulnerable in several spots along the code.
There's a basic input checking function ( TwoSingleQ(str) ) but
it's not applied everywhere, leaving potencial exploitable holes.

The following statement shows the vulnerable points
(taken from addcustomer.asp).

Here "zip", "state", "country", "phone" and "fax" are unchecked for
SQL Injection vulnerabilities.

sqlAdd = "INSERT INTO customers(cfirstname,clastname,cemail,caddress"
If Request.Form("address2") <> "" Then
sqlAdd = sqlAdd & ",caddress2"
end if
sqlAdd = sqlAdd & ",ctown,czip"
If Request.Form("state") <> "" Then
sqlAdd = sqlAdd & ",cstate"
End if
sqlAdd = sqlAdd & ",ccountry,cphone"
If Request.Form("fax") <> "" Then
sqlAdd = sqlAdd & ",cfax"
End if
sqlAdd = sqlAdd & ") VALUES("
sqlAdd = sqlAdd & "'" & TwoSingleQ(fname) & "'"
sqlAdd = sqlAdd & ",'" & TwoSingleQ(lname) & "'"
sqlAdd = sqlAdd & ",'" & TwoSingleQ(email) & "'"
sqlAdd = sqlAdd & ",'" & TwoSingleQ(address) & "'"
If Request.Form("address2") <> "" Then
sqlAdd = sqlAdd & ",'" & TwoSingleQ(Request.Form("address2")) & "'"
end if
sqlAdd = sqlAdd & ",'" & TwoSingleQ(town) & "'"
sqlAdd = sqlAdd & ",'" & zip & "'"
If Request.Form("state") <> "" Then
sqlAdd = sqlAdd & ",'" & Request.Form("state") & "'"
End if
sqlAdd = sqlAdd & ",'" & country & "'"
sqlAdd = sqlAdd & ",'" & phone & "'"
If Request.Form("fax") <> "" Then
sqlAdd = sqlAdd & ",'" & Request.Form("fax") & "'"
End If
sqlAdd = sqlAdd & ")"

At least addcustomer.asp, addprod.asp, process.asp are vulnerable to
this type of attacks.

.: Official Fix Information

The vendor has been contacted but no fix has been released yet.

-----

Ignacio Vazquez


Director of Technology
Security Labs Manager

Centaura Technologies
http://www.centaura.com.ar



Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »