TalentSoft Web+Shop Path Disclosure

Advisory Content :

TalentSoft Web+Shop Path Disclosure

Software: Web+Shop
Version: 5.3.6
Website: http://www.webplus.com
Bug: path disclosure
Exploitation: Remote

Description:
Web+Shop is a user-friendly e-commerce shopping cart application for the
web.

Vulnerability:
Web+Shop installation path can be disclosed by sending a specially crafted
URL.

Example:
http://host/cgi-bin/webplus.exe?script=/webpshop/store.wml&storeid='

which returns:

Web+ Error Message:

Error Code = 10220: Script file error. Occurred in WebInclude around
line(169) in Script File

C:webplusscriptwebpshopscriptinitial.wml
Explanation:

The script file could not be executed because it could not be found or is
corrupt..
Troubleshooting Information

Check the logical and physical paths for
'C:Inetpubwwwrootwebpshopstore_'templatesfpheader.wml' and make sure that
it is in the right directory. Also verify the file's integrity.

Solution:
Quote from the vendor's replay:

"Path Disclosure Issue: We are constantly working on improving the security
of our products. Our next build of Web+ 6.0 will have a configuration that
will allow administrators to disable the display of file and path
information from its error messages. Currently all other server information
can be turned on and off using the Web+ Server Manager.

One thing to note that may help with your particular issue is this: Web+
has a security feature where an administrator can configure which URL Web+
should redirect to if an error 10220 (Script File Error) is encountered. To
configure this, go to the Web+ Server Manager
(http://host/cgi-bin/webplus.exe?script=/admin/admin.wml). The password
needed is the one configured when Web+ was installed.

Click on Logging/Debugging and enter the desired "error" URL in the field,
'Redirect URL for "Script Not Found" Error:'. Then click Apply.

After this is set, any error 10220 will automatically redirect to this
target URL. This may eliminate the particular path disclosure issue you
identified."

Credit:
Discovered by Revnic Vasile
revnic (at) gmail (dot) com [email concealed]

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

TalentSoft Web+Shop Path Disclosure