发布 2010-09-02 漏洞条目

Shop a la Cart – Multiple Vulnerabilities

Exploit Source

# Exploit Title: [Multiple vulnerabilities in SHOP A LA CART]

# Date: [03.09.2010]

# Author: [Ariko-Security]

# Software Link: [http://shopalacart.com]

# Version: [ALL]

# Tested on: [ALL]

# CVE : [n/a]

# Ariko-Security: Security Audits , Audyt bezpieczeństwa

# Advisory: 728/2010

============ { Ariko-Security - Advisory #1/9/2010 } =============

Multiple vulnerabilities in SHOP A LA CART

Vendor's Description of Software:

# http://shopalacart.com/shopping_cart_demo.php

Dork:

# N/A

Application Info:

# Name: SHOP A LA CART

# ALL versions

Vulnerability Info:

# Type: multiple SQL injections, multiple XSS, multiple iFrame

injections, multiple link injections,

Time Table:

# 20/08/2010 - Vendor notified.

Fix:

# n/a

Input passed via the "xGrp" parameter to catgrp.php is not properly

sanitised before being used in a SQL query.

Input passed via the "xCat" parameter to catmain.php and prodmain.php

is not properly

sanitised before being used in a SQL query.

Input passed to the "nLoginUser" ,"nCustPhone" parameters in

account_signup.php is not properly

sanitised before being returned to the user.

Input passed to the "nReferrer" ,"Zipcode" parameters in cart.php is not

properly

sanitised before being returned to the user.

Input passed to the "nPhone" ,"nMailName", "nFullName", "nEmail",

"nComments" parameters in popup_contact.php