bugtraq - [ARL03-A16] Multiple Security Issues in phPay

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030409080353.29012.qmail@www.securityfocus.com>
Date: 9 Apr 2003 08:03:53 -0000
From: Ahmet Sabri ALPER <s_alper@...mail.com>
To: bugtraq@...urityfocus.com
Subject: [ARL03-A16] Multiple Security Issues in phPay

+/--------\-------- ALPER Research Labs ------/--------/+
+/---------\-------  Security Advisory  -----/---------/+
+/----------\------    ID: ARL03-A16    ----/----------/+
+/-----------\----- salper@...mpos.org  ---/-----------/+

Advisory Information
--------------------
Name               : Multiple Security Issues in phPay
Software Package   : phPay
Vendor Homepage    : http://phpay.sourceforge.net/
Vulnerable Versions: v2.02 and possibly older versions
Platforms          : OS Independent, PHP & MySQL
Vulnerability Type : Input Validation Error
Vendor Contacted   : 20/02/2003
Vendor Replied     : 20/02/2003
Prior Problems     : N/A
Current Version    : v2.02.1 (problem fixed)

Summary
-------
phPay is an ecommerce, webshop and catalogue system for PHP4 &MySQL.
It supports several languages and includes many functions for an online
shopping area.

Multiple path disclosure, information leakage and a Cross Site Scripting
problem exist within "phPay v2.02".

Details
-------
1. Cross Site Scripting vulnerability in search.php
Example:
http://[TARGET]/search.php?sess=your_session_id&lookfor=&lt;script&gt;alert
(document.cookie)&lt;/script&gt;

2. Path disclosure vulnerability, when a non-existent language is selected.
Example:
http://[TARGET]/login.php?
sess=your_session_id&abt=&new_lang=99999&caller=navlang
Output:
>Fatal error: Failed opening required 'lang/.inc.php'
>(include_path='.:/usr/share/php') in /home/web/html/phpay/lib.inc.php on
>line 10

3. Path disclosure in start.php when pointing to a non existent file, this 
might also 
allow inclusion of arbitrary remote files.
Example:
http://[TARGET]/start.php?config=alper.inc.php
Output:
>Fatal error: Failed opening required './alper.inc.php'
>(include_path='.:/usr/share/php') in /home/web/html/phpay/start.php on
>line 17

4. You may stop by and watch the phpinfo(); for the site in 
/admin/phpinfo.php

5. Path disclosure in /doc/addon-index.php (because of an extra ../ in the 
include path).

6. Several other path disclosure vulnerabilities when scripts and include 
files are directly called.
Examples:
detail.php, fpass.php, header.inc.php, main.php, nav.php, pay.php,
payed.php, publicpay.inc.php, reguser.php, search.php, server.php,
view_cart.php, lib.inc.php, show_size.inc.php, limit.navi.inc.php,
mailer.inc.php, show_cart.inc.php, stats.php, show_color.inc.php,
show_content.inc.php, show_item_0.inc.php, show_item_1.inc.php,
show_item_x.inc.php, show_item_2.inc.php

7. Some more path disclosure vulnerabilities in the "admin" directory.

Solution
--------
A new version which addresses the listed vulnerabilities has been 
released. Downloadable from;
http://sourceforge.net/projects/phpay

Credits
-------
Discovered on 20, February, 2003 by
Ahmet Sabri ALPER <salper@...mpos.org>
ALPER Research Labs.

The ALPER Research Labs. [ARL] workers are freelancer
security professionals and WhiteHat hackers. The ARL
workers are available for hiring for legal jobs.
The ARL also supports Open Software Community, by detecting
possible security issues in GPL or any other Public Licensed
product.

References
----------
Product Web Page: http://phpay.sourceforge.net/
Olympos: http://www.olympos.org/