DCShop Beta Form Manipulation Vulnerability
BID:4356
Info
DCShop Beta Form Manipulation Vulnerability
| Bugtraq ID: | 4356 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 25 2002 12:00AM |
| Updated: | Mar 25 2002 12:00AM |
| Credit: | Discovery of this issue is credited to pokleyzz sakamaniaka <[email protected]>. |
| Vulnerable: |
DC Scripts DCShop Beta 1.0 02 DC Scripts DCShop Beta 1.0 01 |
| Not Vulnerable: | |
Discussion
DCShop Beta Form Manipulation Vulnerability
DCShop Beta is a freely available shopping cart system, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.
It is possible to overwrite setup files (*.setup) by submitting attacker-supplied form data followed by a null character (%00). The attacker must use the POST method to submit data that is content-type multipart/form-data compliant.
DCShop Beta is a freely available shopping cart system, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.
It is possible to overwrite setup files (*.setup) by submitting attacker-supplied form data followed by a null character (%00). The attacker must use the POST method to submit data that is content-type multipart/form-data compliant.
Exploit / POC
DCShop Beta Form Manipulation Vulnerability
The following example was submitted:
curl -F [email protected] http://host/cgi-bin/dcshop.cgi
where test.txt contains databasename.setup[nullbyte].
The following example was submitted:
curl -F [email protected] http://host/cgi-bin/dcshop.cgi
where test.txt contains databasename.setup[nullbyte].
Solution / Fix
DCShop Beta Form Manipulation Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.