########################################################## # GulfTech Security Research July 28, 2008 ########################################################## # Vendor : ViArt, Ltd # URL : http://www.viart.com/ # Version : ViArt Shop <= 3.5 # Risk : SQL Injection ########################################################## Description: ViArt Shop is a full featured online ecommerce solution written in php. There is a high risk SQL Injection in ViArt that allows for an attacker to take over the ViArt installation. This vulnerability is present regardless of magic_quotes configuration. An updated version of ViArt has been released and all users are encouraged to upgrade their ViArt installation as soon as possible. SQL Injection: There is a high risk SQL Injection vulnerability in ViArt that allows for an attacker to run arbitrary queries via a malicious request. The vulnerable code can be found in "products_rss.php". As seen below the "$category_id" variable is never sanitized within the query, and is never sanitized prior to that point either. if ($category_id == 0){ $sql = "SELECT category_id, friendly_url FROM " . $table_prefix . "categories WHERE category_path like '%".$category_id.",%' AND is_showing = 1 "; } else { $sql = "SELECT category_id, friendly_url FROM " . $table_prefix . "categories WHERE category_path like '%,".$category_id.",%' AND is_showing = 1 "; } This allows for an attacker to easily select arbitrary data from the database such as usernames,passwords, and even credit card information. it should also be noted that ViArt strips slashes from within the get_param() function, so magic_quotes does not prevent this SQL Injection from happening. /products_rss.php?category_id=1' UNION SELECT concat(login,char(58),password),0 FROM va_admins -- /* A url like the one above will successfully grab the admin info from the database, and then attempt to use the admin data in a query, where it will then error. Still, the admin credentials will be displayed in the SQL Error as part of the faulty query and visible to the attacker. It is also worth mentioning that ViArt stores all credentials in plain text, so once an attacker has the credentials he is guaranteed access to the application. Solution: The ViArt developers have released a patch for the vulnerable ViArt 3.5. Users are encouraged t upgrade as soon as possible. Credits: James Bercegay of the GulfTech Security Research Team Related Info: The original advisory can be found at the following location http://www.gulftech.org/?node=research&article_id=00118-07292008