osCommerce products_id URI Parameter SQL Injection Vulnerability
BID:9275
Info
osCommerce products_id URI Parameter SQL Injection Vulnerability
| Bugtraq ID: | 9275 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 22 2003 12:00AM |
| Updated: | Dec 22 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to JeiAr <[email protected]>. |
| Vulnerable: |
osCommerce osCommerce 2.2 ms2 osCommerce osCommerce 2.2 ms1 |
| Not Vulnerable: | |
Discussion
osCommerce products_id URI Parameter SQL Injection Vulnerability
It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack.
It has been reported that an attacker may supply malicious SQL queries as a URI parameter to the affected script. The attacker may leverage this condition to manipulate the logic and structure of database queries, possibly resulting in osCommerce compromise, information disclosure or other consequences.
It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack.
It has been reported that an attacker may supply malicious SQL queries as a URI parameter to the affected script. The attacker may leverage this condition to manipulate the logic and structure of database queries, possibly resulting in osCommerce compromise, information disclosure or other consequences.
Exploit / POC
osCommerce products_id URI Parameter SQL Injection Vulnerability
The following proof of concept has been supplied:
http://www.example.com/default.php?cPath=[MID]&sort=5a&page=1&action=buy_now&products_id=[PID][JNK]
[MID] = A Valid Manufacturer ID Number
[PID] = A Valid Product ID Number
[JNK] = SQL query or junk. %22 %5C %27 or %00 Will cause a DoS
The following proof of concept has been supplied:
http://www.example.com/default.php?cPath=[MID]&sort=5a&page=1&action=buy_now&products_id=[PID][JNK]
[MID] = A Valid Manufacturer ID Number
[PID] = A Valid Product ID Number
[JNK] = SQL query or junk. %22 %5C %27 or %00 Will cause a DoS
Solution / Fix
osCommerce products_id URI Parameter SQL Injection Vulnerability
Solution:
It has been reported that a fix to address this issue is pending release; customers are advised to contact the vendor for further details.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that a fix to address this issue is pending release; customers are advised to contact the vendor for further details.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
osCommerce products_id URI Parameter SQL Injection Vulnerability
References:
References:
- osCommerce Homepage (osCommerce)
- osCommerce SQL Injection && DoS && Cross Site Scripting (JeiAr