0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
CubeCart PHP (shipkey parameter) <= 4.3.x Remote SQL Injection
============================================================== CubeCart PHP (shipkey parameter) <= 4.3.x Remote SQL Injection ============================================================== SQL Injection in CubeCart PHP Free & Commercial Shopping Cart Application 1. *Advisory Information* Title: SQL Injection in CubeCart PHP Free & Commercial Shopping Cart Application Advisory Id: CORE-2010-0415 Advisory URL: [http://www.coresecurity.com/content/cubecart-php-shopping-cart-sql-injection] Date published: 2010-06-08 Date of last update: 2010-06-08 Vendors contacted: CubeCart Release mode: Coordinated release 2. *Vulnerability Information* Class: SQL injection [CWE-89] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2010-1931 Bugtraq ID: N/A 3. *Vulnerability Description* There is an SQL Injection[1] vulnerability in the CubeCart PHP Shopping cart[2], this vulnerability may be exploited by 'HTTP POST'ing mailicious data to the index.php script of CubeCart. As an example, exploitation may result in leak of sensitive information or injection of mailicious code into the shopping cart's web page. 4. *Vulnerable packages* . CubeCart v.4.3.4 . CubeCart v.4.3.5 . CubeCart v.4.3.6 . CubeCart v.4.3.7 . CubeCart v.4.3.8 . CubeCart v.4.3.9 . Older versions are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . CubeCart v.4.4.0 6. *Vendor Information, Solutions and Workarounds* Upgrade to the latest version of CubeCart, available at CubeCart's web page[1]. 7. *Credits* This vulnerability was discovered and researched by 7Safe [http://www.7safe.com/]. This advisory was coordinated by Pedro Varangot [http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=researcher&name=Pedro_Varangot]. 8. *Technical Description / Proof of Concept Code* The shipKey parameter of the following POST request (Updating basket) is not adequately sanitized resulting in SQL Injection. /----- POST /CubeCart/index.php?_g=co&_a=step2 HTTP/1.1 Cookie: [...] Content-Type: application/x-www-form-urlencoded [...] quan%5B3afcdbfeb6ecfbdd0ba628696e3cc163%5D=3&shipKey=1'&coupon= - -----/ This happens because the 'shipKey' is assumed to be of the 'int' datatype, and is not cast nor checked before sent to the database, as we can see in the folling code snippet: /----- if(isset($_POST['shipKey']) && $_POST['shipKey']>0) { $cart->setVar($_POST['shipKey'],'shipKey'); // lose post vars $refresh = true; } - -----/ The following snippet correctly patches this bug: /----- if(isset($_POST['shipKey']) && (int)$_POST['shipKey']>0) { $cart->setVar((int)$_POST['shipKey'],'shipKey'); // lose post vars $refresh = true; } - -----/ # 0day.today [2024-07-01] #