发布 2010-11-19 漏洞条目

ViArt Shop 4.0.5 – Multiple Vulnerabilities

Exploit Source

# Title: [ViArt SHOP multiple vulnerabilities]

# Date: [18.11.2010]

# Author: [Ariko-Security]

# Software Link: [http://www.viart.com]

# Version: [4.0.5]

============ { Ariko-Security - Advisory #2/11/2010 } =============

ViArt SHOP multiple vulnerabilities

Vendor's Description of Software and demo:

# http://demo-shop.viart.com/ & http://www.viart.com

Dork:

# N/A

Application Info:

# ViArt SHOP

# version last 4.0.5

Vulnerability Info:

# Type: multiple SQL injections, multiple XSS, multiple iFrame injections, multiple link injections , redirector abuse.

Time Table:

# 10/11/2010 - Vendor notified.

# 18/11/2010 - Vendor released fix (partial)

Fix:

# http://www.viart.com/update_logic_to_increase_site_security_and_fix_xss-compatibility_issues.html

SQL injections:

Input passed via the "rnd" parameter to products_search.php is not properly

sanitised before being used in a SQL query.

Input passed via the "filter" parameter to products.php is not properly

sanitised before being used in a SQL query.

XSS, iFrame Injections, Link injections:

Input passed to the "search_category_id" and "category_id" parameters in ads.php is not properly