iSoft-Solutions QuikStore Shopping Cart store Parameter Path Disclosure Vulnerability
BID:9282
Info
iSoft-Solutions QuikStore Shopping Cart store Parameter Path Disclosure Vulnerability
| Bugtraq ID: | 9282 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 23 2003 12:00AM |
| Updated: | Dec 23 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Dr Ponidi Haryanto <[email protected]>. |
| Vulnerable: |
iSoft-Solutions QuikStore Shopping Cart 2.12 |
| Not Vulnerable: | |
Discussion
iSoft-Solutions QuikStore Shopping Cart store Parameter Path Disclosure Vulnerability
It has been reported that QuikStore Shopping Cart may be prone to an information disclosure vulnerability due to insufficient sanitization of user-supplied data through the 'store' parameter of the 'quikstore.cgi' script. An attacker may dislcose the installation path of a file by making a malformed request and passing a single quote "'" character to generate an error message. The error message is reported to contain sensitive information such as the installation path.
Specific vulnerable versions of the software were not identified in the report; therefore it is assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue.
It has been reported that QuikStore Shopping Cart may be prone to an information disclosure vulnerability due to insufficient sanitization of user-supplied data through the 'store' parameter of the 'quikstore.cgi' script. An attacker may dislcose the installation path of a file by making a malformed request and passing a single quote "'" character to generate an error message. The error message is reported to contain sensitive information such as the installation path.
Specific vulnerable versions of the software were not identified in the report; therefore it is assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue.
Exploit / POC
iSoft-Solutions QuikStore Shopping Cart store Parameter Path Disclosure Vulnerability
The following proof of concept has been provided:
http://[target]/cgi-bin/quikstore.cgi?store='
The following proof of concept has been provided:
http://[target]/cgi-bin/quikstore.cgi?store='
Solution / Fix
iSoft-Solutions QuikStore Shopping Cart store Parameter Path Disclosure Vulnerability
Solution:
The vendor has released a patch to address this issue. Users are advised to update their software via the Web Update feature from the QuikStore Main
Menu. Versions prior to QuikStore 2.12 may be updated by contacting the vendor.
Solution:
The vendor has released a patch to address this issue. Users are advised to update their software via the Web Update feature from the QuikStore Main
Menu. Versions prior to QuikStore 2.12 may be updated by contacting the vendor.
References
iSoft-Solutions QuikStore Shopping Cart store Parameter Path Disclosure Vulnerability
References:
References:
- QuikStore (iSoft-Solutions)