CyberStrong Shopping Cart - Advisory & Exploit Code

[<aresu () bosen net>]

Advisory Name: Cyberstrong eShop SQL Injection Vulnerability
Release Date: 05/07/2003
Application: CyberStrong eShop v4.2
Platform: Win32/MSSQL
Severity: High
BUG Type: SQL Injection
Discover by: AresU <aresu () bosen net>
Author: Bosen <mobile () bosen net>
Vendor Status: See below.
Vendor URL: http://www.cyberstrong.com/eshop
Reference: http://bosen.net/releases/

Overview:
For the commersial break pls visit
http://www.cyberstrong.com/eshop/features.asp
I know there's lotsa features there.

Details:
CyberStrong provide trial/demo software, in encrypted thought.
But the encryption not as big as its sounds like.

Well, the bugs lies on the application libraries.
And got fired via 10expand.asp, 10browse.asp, and 20review.asp.

With manipulated SQL injection, an attacker would be able to gain some
information including admin's user and admin's password.
Which is can be used thorugh web based admin interface on
/admin/mlogin.asp.

Exploits/POC:
http://[target]/eshop/10Expand.asp?ProductCode=&apos;
http://[target]/eshop/20Review.asp?ProductCode=&apos;

Vendor Response:
Contacted. No response.

Recommendation:
No recommendation for this.
For workaround, just protect /admin dir with .htpasswd.
(but its not very effective, an attacker still can do query, but at least it
would be slowing their jobs)

1ndonesian Security Team (1st) Advisory:
http://bosen.net/releases/

About 1ndonesian Security Team:
1ndonesian Security Team, research and develop intelligent, advanced
application security assessment. Based in Indonesia, 1ndonesian Security
Team offers best of breed security consulting services, specialising in
application, host and network security assessments.

1st provides security information and patches for use by the entire 1st
community.

This information is provided freely to all interested parties and may be
redistributed provided that it is not altered in any way, 1st is
appropriately
credited and the document retains.

Greetz to:
Bosen, TioEuy,Ipunk, Heltz, Gembul,TomIngShUu, sakitjiwa, muthafuka,
alphacentury,
All 1ndonesian Security Team - #hackers () austnet org/centrin.net.id

AresU <aresu () bosen net>
======================
Original document can be fount at http://www.bosen.net/releases/?id=23