full-disclosure - ASPilot Pilot Cart 7.3 multiple vulnerabilities addition to CVE-2008-2688

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 7 Nov 2010 13:41:13 +0100
From: Maciej Gojny <vuln@...ko-security.com>
To: full-disclosure@...ts.grok.org.uk
Subject: ASPilot Pilot Cart 7.3 multiple vulnerabilities
	addition to CVE-2008-2688

# Title: [ASPilot Pilot Cart 7.3 multiple vulnerabilities]
# Date: [07.11.2010]
# Author: [Ariko-Security]
# Software Link: [http://www.pilotcart.com]
# Version: [7.3]

# CVE Reference: CVE-2008-2688 (only 1 SQL injection) 
# EDB-ID: 5765 (only 1 SQL injection)

# Ariko-Security: Security Audits , Audyt bezpieczeństwa
# Advisory: 745/2010

============ { Ariko-Security - Advisory #1/11/2010 } =============

ASPilot Pilot Cart 7.3 multiple vulnerabilities

Vendor's Description of Software and demo:
# http://www.pilotcart.com

Dork:
# Powered by Pilot Cart V.7.3

Application Info:
# Name: Pilot Cart 
# version last 7.3

Vulnerability Info:
# Type: multiple SQL injections, multiple XSS, multiple iFrame injections, multiple link injections.

Time Table:
# 29/10/2010 - Vendor notified.

Fix:
# n/a

5x SQL injection

Input passed via the "article" parameter to pilot.asp and kb.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "specific" parameter to cart.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "countrycode" parameter to contact.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "srch" parameter to search.asp is not properly
sanitised before being used in a SQL query.

5x link injections, 5x XSS, 5xiFrame injections.

Input passed to the "countrycode" parameter in contact.asp is not properly
sanitised before being returned to the user.

Input passed to the "USERNAME" parameter in gateway.asp and cart.asp is not properly
sanitised before being returned to the user.

Input passed to the "specific" parameter in quote.asp and buyitnow.asp is not properly
sanitised before being returned to the user.

Link injections:
http://www.pilotcart.com/contact.asp
countrycode=[link]
http://www.pilotcart.com/gateway.asp 
USERNAME=[link]
http://www.pilotcart.com/quote.asp 
specific=[link]

http://www.pilotcart.com/cart.asp?mode=checklogin
[POST] USERNAME=[link]
http://www.pilotcart.com/buyitnow.asp?doit=yes
[POST] specific=[link]

XSS:
http://www.pilotcart.com/contact.asp
countrycode=XSS
http://www.pilotcart.com/gateway.asp 
USERNAME=XSS
http://www.pilotcart.com/quote.asp
specific=XSS

http://www.pilotcart.com:80/cart.asp?mode=checklogin
[POST] USERNAME=XSS
http://www.pilotcart.com:80/buyitnow.asp?doit=yes
[POST] specific=XSS

iFrame Injections:
http://www.pilotcart.com/contact.asp 
countrycode=[iFrame]
http://www.pilotcart.com/gateway.asp 
USERNAME=[iFrame]
http://www.pilotcart.com/quote.asp
specific=[iFrame]

http://www.pilotcart.com:80/cart.asp?mode=checklogin
[POST] USERNAME=[iFrame]
http://www.pilotcart.com:80/buyitnow.asp?doit=yes
[POST] specific=[iFrame]

Solution:
# Input validation of all vulnerable parameters should be corrected.

Credit:
# Discoverd By: Maciej Gojny / Ariko-Security 2010
Advisory:
# http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html

Ariko-Security Sp. z o.o.
Rynek Glowny 12
32-600 Oswiecim
tel:. +48 33 4741511 mobile: +48 784086818
(Mo-Fr 10.00-20.00 CET)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/