SunShop Shopping Cart User-Embedded Scripting Vulnerability

Bugtraq ID:	4506
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 13 2002 12:00AM
Updated:	Apr 13 2002 12:00AM
Credit:	Discovery of this vulnerability is credited to ppp-design <[email protected]>.
Vulnerable:	TurnkeyWebTools SunShop Shopping Cart 2.5 TurnkeyWebTools SunShop Shopping Cart 2.4 TurnkeyWebTools SunShop Shopping Cart 2.2 TurnkeyWebTools SunShop Shopping Cart 2.1 TurnkeyWebTools SunShop Shopping Cart 2.0 TurnkeyWebTools SunShop Shopping Cart 1.5
Not Vulnerable:	TurnkeyWebTools SunShop Shopping Cart 2.6

SunShop Shopping Cart User-Embedded Scripting Vulnerability

SunShop is commercial web store software. It is written in PHP, and will run on most Unix and Linux operating systems as well as Microsoft Windows.

SunShop allows attackers to embed arbitrary script code into form fields. This may enable a remote attacker to perform actions as the administrative user of the shopping cart.

SunShop Shopping Cart User-Embedded Scripting Vulnerability

The following proof-of-concept was provided:

Enter the following name when registering as a new customer:

blackhat<script>alert('ouch')</script>

SunShop Shopping Cart User-Embedded Scripting Vulnerability

Solution:
This issue has been addressed in version 2.6 of the software. Administrators are advised to upgrade.

SunShop Shopping Cart User-Embedded Scripting Vulnerability

References:

• SunShop Shopping Cart Homepage (TurnkeyWebTools)