|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 2730 CVE : CVE-2007-2862 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : No Credit : John Martinelli Published : 29.05.2007
Advisory Content : An interesting SQL injection vulnerability was discovered in CubeCart v3.0.16. This vulnerability cannot easily be exploited by traditional means - in fact, the actual vulnerable variable was not discovered. As a piece of user input is passed to CubeCart, it is sanitized through a routine mySQLSafe - all except the variable $option in include/blah/cart.inc.php as well as other files in the same directory. The vulnerability was only reproduced by RedLevel with the Acunetix Web Vulnerability Scanner. The vulnerability evidently 'poisons' data attached with the user's cookie. The following error message displays an example of the injection: --- begin --- MySQL Error Occured 1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Set-Cookie' at line 2 QUERY = SELECT cc3_CubeCart_options_bot.option_id, cc3_CubeCart_options_bot.value_id, option_price, option_symbol, assign_id FROM `cc3_CubeCart_options_bot` INNER JOIN `cc3_CubeCart_options_mid` ON cc3_CubeCart_options_mid.value_id = cc3_CubeCart_options_bot.value_id INNER JOIN `cc3_CubeCart_options_top` ON cc3_CubeCart_options_bot.option_id = cc3_CubeCart_options_top.option_id WHERE assign_id = Set-Cookie --- end --- To solve this vulnerability, the variable $option should be sanitized with mySQLSafe in all include files. John Martinelli john (at) martinelli (dot) com [email concealed] RedLevel Security http://www.RedLevel.org May 21st, 2007  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |