iScripts MultiCart 2.2 – Multiple SQL Injections
iScripts MultiCart 2.2 Multiple SQL Injection Vulnerability Name iScripts MultiCart Vendor http://www.iscripts.com Versions Affected 2.2 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-03-07 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION iScripts MultiCart 2.2 is a unique online shopping cart solution that enables you to have one storefront and multiple vendors for physical or digital (downloadable) products. II. DESCRIPTION The solution adopted to avoid SQL Injection flaws is not appropriate. This allows the existence of many SQL Injection flaws. III. ANALYSIS Summary: A) Multiple SQL Injection A) Multiple SQL Injection The solution adopted consists in transforming the query string in uppercase and checking the existence of the words UNION and SELECT. But using the C-like comments in the query string, it is possible to bypass the filter. Example: SELECT becomes SE/**/LE/**/CT UNION becomes UN/**/ION The new strings do not match with the words in the black list but they are good for MySQL. The following is the affected code (session.php): $mystring = strtoupper($_SERVER['QUERY_STRING']); $server_injec1=strpos($mystring, 'SELECT'); $server_injec2=strpos($mystring, 'UNION'); if (($server_injec1 === false) && ($server_injec2 === false) || ($server_injec1 === '0') && ($server_injec2 === '0')) { ; }//end if else { header('location:index.php'); exit(); } IV. SAMPLE CODE A) Multiple SQL Injection http://site/path/refund_request.php?orderid=SQL V. FIX No Fix. |