Brooky CubeCart SQL Injection Vulnerability

Bugtraq ID:	11337
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 06 2004 12:00AM
Updated:	Oct 06 2004 12:00AM
Credit:	Pedro Sanches <[email protected]> disclosed this vulnerability.
Vulnerable:	CubeCart CubeCart 2.0.1
Not Vulnerable:

Brooky CubeCart SQL Injection Vulnerability

It is reported that CubeCart is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI data prior to including it in an SQL query.

An attacker may exploit this issue to manipulate SQL queries, potentially revealing or corrupting sensitive database data. This issue may also facilitate attacks against the underlying database software.

This vulnerability is reported to exist in version 2.0.1 of CubeCart. Other versions may also be affected.

Brooky CubeCart SQL Injection Vulnerability

An exploit is not required. An example URI sufficient to exploit this vulnerability was provided:

http://www.example.com/store/index.php?cat_id=1 or 1=1

Brooky CubeCart SQL Injection Vulnerability

Solution:
The vendor has recommended the following fix:
INSERT
if (!is_numeric($cat_id))
unset($cat_id);

BEFORE
include("header.inc.php");

IN
index.php

Brooky CubeCart SQL Injection Vulnerability

References:

• Check this out!, Full path disclosure and sql injection (CubeCart Forums)
  
• CubeCart Home Page (Brooky)
  
• Full path disclosure and sql injection on CubeCart 2.0.1 (Pedro Sanches )