SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
WLB
Services
RSS
Corporate
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com

Home arrow SecurityAlert Database

Arrow  Topic :

CubeCart v3.0.16 SQL Injection Vulnerability


Arrow  SecurityAlert : 2730
Arrow  CVE : CVE-2007-2862
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : No
Arrow  Credit : John Martinelli
Arrow  Published : 29.05.2007

Arrow  Affected Software : CubeCart v3.0.16



Arrow  Advisory Content :  

An interesting SQL injection vulnerability was discovered in CubeCart
v3.0.16. This vulnerability cannot easily be exploited by traditional means
- in fact, the actual vulnerable variable was not discovered.

As a piece of user input is passed to CubeCart, it is sanitized through a
routine mySQLSafe - all except the variable $option in
include/blah/cart.inc.php as well as other files in the same directory.

The vulnerability was only reproduced by RedLevel with the Acunetix Web
Vulnerability Scanner. The vulnerability evidently 'poisons' data attached
with the user's cookie. The following error message displays an example of
the injection:

--- begin ---

MySQL Error Occured
1064: You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'Set-Cookie' at line 2

QUERY = SELECT cc3_CubeCart_options_bot.option_id,
cc3_CubeCart_options_bot.value_id, option_price, option_symbol, assign_id
FROM `cc3_CubeCart_options_bot` INNER JOIN `cc3_CubeCart_options_mid` ON
cc3_CubeCart_options_mid.value_id = cc3_CubeCart_options_bot.value_id INNER
JOIN `cc3_CubeCart_options_top` ON cc3_CubeCart_options_bot.option_id =
cc3_CubeCart_options_top.option_id WHERE assign_id = Set-Cookie

--- end ---

To solve this vulnerability, the variable $option should be sanitized with
mySQLSafe in all include files.

John Martinelli
john (at) martinelli (dot) com [email concealed]

RedLevel Security
http://www.RedLevel.org

May 21st, 2007





Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...

Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration

PHP RSS PHP Alert

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass

» PHP 5.3.0 5.2.11
   posix_mkfifo()
   open_basedir bypass

Copyright © SecurityReason.com. All Rights Reserved.