Brooky CubeCart Multiple Vulnerabilities
BID:12549
Info
Brooky CubeCart Multiple Vulnerabilities
| Bugtraq ID: | 12549 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 14 2005 12:00AM |
| Updated: | Feb 14 2005 12:00AM |
| Credit: | Discovery is credited to John Cobb <[email protected]>. |
| Vulnerable: |
CubeCart CubeCart 2.0.4 CubeCart CubeCart 2.0.1 |
| Not Vulnerable: |
CubeCart CubeCart 2.0.5 |
Discussion
Brooky CubeCart Multiple Vulnerabilities
Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.
The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.
The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.
CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues.
Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.
The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.
The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.
CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues.
Exploit / POC
Brooky CubeCart Multiple Vulnerabilities
An exploit is not required.
The following proof of concept examples are available:
http://www.example.com/index.php?&language=../../../../../../../../etc/pa
sswd
http://www.example.com/index.php?&language=<script>var%20test_variable=31
337;alert(test_variable);</script>
An exploit is not required.
The following proof of concept examples are available:
http://www.example.com/index.php?&language=../../../../../../../../etc/pa
sswd
http://www.example.com/index.php?&language=<script>var%20test_variable=31
337;alert(test_variable);</script>
Solution / Fix
Brooky CubeCart Multiple Vulnerabilities
Solution:
The vendor has released CubeCart 2.0.5 to address these issue. Please contact the vendor to obtain the fixed version.
Solution:
The vendor has released CubeCart 2.0.5 to address these issue. Please contact the vendor to obtain the fixed version.
References
Brooky CubeCart Multiple Vulnerabilities
References:
References:
- CubeCart Home Page (Brooky)
- CubeCart 2.0.4 - Multiple Vulnerabilities ("John Cobb"