Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in CS-Cart 1. *Advisory Information* Title: SQL Injection in CS-Cart Advisory ID: BONSAI-2009-0100 Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/cs-cart_SQL-injection -0100.txt Date published: 2009-08-04 Vendors contacted: CS-Cart Release mode: Coordinated release 2. *Vulnerability Information* Class: SQL Injection Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2009-2579 3. *Software Description* CS-Cart is an "out of the box" ecommerce software solution with easy-to-use functionality that allows to start selling online immediately. Its feature set fits into businesses of any size, from a small single-product shop to a fully-featured online storefront [0]. 4. *Vulnerability Description* SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. For additional information, please look at references [1] and [2]. 5. *Vulnerable packages* Version <= 2.0.5 6. *Non-vulnerable packages* CS-Cart developers informed us that all users should upgrade to the latest version of CS-Cart, (CS-Cart 2.0.6) which fixes this vulnerability. More information to be found here: http://kb2.simtech/how-to-upgrade 7. *Credits* This vulnerability was discovered by Ryan Dewhurst ( ryan -at- bonsai-sec.com ). 8. *Technical Description* A SQL injection vulnerability was found in the reward_points.post.php script, more specifically in the $sort_order variable. The vulnerability can be triggered by logging into CS-Cart and browsing to: /index.php?dispatch=reward_points.userlog&result_ids=pagination_contents &sort_by=timestamp&sort_order=' Which will generate a syntax error in the database. The following is the corresponding piece of code: reward_points.post.php:69 $userlog = db_get_array("SELECT change_id, action, timestamp, amount, reason FROM ?:reward_point_changes WHERE user_id = ?i ORDER BY $sort_by $sort_order $limit", $user_id); More information about how to exploit this SQL injection vulnerability can be found at Bonsai's blog [3] 9. *Report Timeline* - 2009-07-06: Bonsai notifies CS-Cart team of the vulnerability. Technical details are sent to the developers. - 2009-07-09: CS-Cart acknowledges and fixes vulnerability, setting release date of the upgrade to 15 July 2009. - 2009-08-04: The advisory BONSAI-2009-0100 is published. 10. *References* [0] http://www.cs-cart.com/ [1] http://www.owasp.org/index.php/SQL_injection [2] http://en.wikipedia.org/wiki/SQL_injection [3] http://www.bonsai-sec.com/blog/ 11. *About Bonsai* Bonsai is a company involved in providing professional computer information security services. Currently a sound growth company, since its foundation in early 2009 in Buenos Aires, Argentina, we are fully committed to quality service, and focused on our customers? real needs. 12. *Disclaimer* The contents of this advisory are copyright (c) 2009 Bonsai Information Security, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.