bugtraq - A-CART Pro & A-CART 2.0 Input Validation Holes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040329123001.12020.qmail@gulo.org>
Date: Mon, 29 Mar 2004 14:30:01 +0200
From: "Manuel Lopez" <mantra@...o.org>
To: bugtraq@...urityfocus.com
Subject: A-CART Pro & A-CART 2.0 Input Validation Holes

#Title: A-CART Pro & A-CART 2.0 Input Validation Holes 

#Software: A-CART Pro & A-CART 2.0
#Vendor: http://www.alanward.net
#Underlying OS:  Windows. 

#Description: 

A-CART is an ASP shopping cart application written in VBScript. The system 
allows a customer to browse through an inventory of products and add these 
items to their virtual shopping cart. Features include hierarchial 
categories, featured product, custom attributes and user profiles. 

#Vulnerabilities: 

A-CART input validation holes let remote users inject SQL and conduct 
Cross-Site Scripting attacks. 

#SQL Injection# 

An Sql injection vulnerability allows a remote attacker to execute malicious 
SQL statements on the database to gain Administrator access. 

/category.asp?catcode=[SqlInjection] 

#-Exploit-# 

http://host/category.asp?catcode=1%20union%20all%20select%20pass,0,0,0,0%20f 
rom%20customers%20where%20fname='[Username]' 

#Cross-Site Scripting# 

This product is vulnerable to the Cross-Site Scripting vulnerability that 
would allow attackers to inject HTML and script codes into the pages and 
execute it on the client's browser.
The vulnerability exists on the user information forms in deliver.asp, 
billing.asp. 

#Solution: 

No solution was available at the time of this entry. Vendor contacted three 
times and three unanswered mails. 

#Credits: 

Manuel López. mantra@...o.org