Virtual Programming VP-ASP Shoperror Script Cross-Site Scripting Vulnerability
BID:10534
Info
Virtual Programming VP-ASP Shoperror Script Cross-Site Scripting Vulnerability
| Bugtraq ID: | 10534 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 14 2004 12:00AM |
| Updated: | Jun 14 2004 12:00AM |
| Credit: | This issue was reported by "Thomas Ryan" <[email protected]>. |
| Vulnerable: |
Virtual Programming VP-ASP 5.00 Virtual Programming VP-ASP 4.50 Virtual Programming VP-ASP 4.00 |
| Not Vulnerable: | |
Discussion
Virtual Programming VP-ASP Shoperror Script Cross-Site Scripting Vulnerability
A vulnerability exists in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'shoperror.asp' script.
An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.
VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.
A vulnerability exists in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'shoperror.asp' script.
An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.
VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.
Exploit / POC
Virtual Programming VP-ASP Shoperror Script Cross-Site Scripting Vulnerability
No exploit is required.
The following proof of concept examples are available:
http://www.example.com/vpasp/shoperror.asp?msg=<img%20src="javascript:alert('XSS')">
http://www.example.com/vpasp/shoperror.asp?msg=<meta%20http-equiv='refresh'content=
'0'>
No exploit is required.
The following proof of concept examples are available:
http://www.example.com/vpasp/shoperror.asp?msg=<img%20src="javascript:alert('XSS')">
http://www.example.com/vpasp/shoperror.asp?msg=<meta%20http-equiv='refresh'content=
'0'>
Solution / Fix
Virtual Programming VP-ASP Shoperror Script Cross-Site Scripting Vulnerability
Solution:
The vendor has recommended the following fix. Edit file shop$db.asp. Add the line 'rc=instr(lmsg, "=")' to the location that it appears in the following code segment:
Locate these lines
Sub CleanseMessage (msg, rc)
dim lmsg, pos
lmsg=lcase(msg)
pos=instr(lmsg, "<script>")
If pos> 0 then
rc=4
else
rc=0
rc=instr(lmsg, "=")
end if
end sub
Further information regarding this fix can be found at the following location:
http://www.vpasp.com/virtprog/info/faq_securityfixes.htm
Solution:
The vendor has recommended the following fix. Edit file shop$db.asp. Add the line 'rc=instr(lmsg, "=")' to the location that it appears in the following code segment:
Locate these lines
Sub CleanseMessage (msg, rc)
dim lmsg, pos
lmsg=lcase(msg)
pos=instr(lmsg, "<script>")
If pos> 0 then
rc=4
else
rc=0
rc=instr(lmsg, "=")
end if
end sub
Further information regarding this fix can be found at the following location:
http://www.vpasp.com/virtprog/info/faq_securityfixes.htm
References
Virtual Programming VP-ASP Shoperror Script Cross-Site Scripting Vulnerability
References:
References:
- Fix Summary (Virtual Programming)
- June 10, 2004 - Security Fix VP-ASP 5.0 (Virtual programming)
- VP-ASP Homepage (Virtual Programming )
- VP-ASP Security FAQ (Virtual Programming)
- VP-ASP Shopping Cart Multiple Vulnerabilities ("Thomas Ryan"