RedLevel Advisory #021 - CubeCart v3.0.16 SQL Injection Vulnerability

An interesting SQL injection vulnerability was discovered in CubeCart v3.0.16. 
This vulnerability cannot easily be exploited by traditional means - in fact, 
the actual vulnerable variable was not discovered.

As a piece of user input is passed to CubeCart, it is sanitized through a 
routine mySQLSafe - all except the variable $option in 
include/blah/cart.inc.php as well as other files in the same directory.

The vulnerability was only reproduced by RedLevel with the Acunetix Web 
Vulnerability Scanner. The vulnerability evidently 'poisons' data attached with 
the user's cookie. The following error message displays an example of the 
injection:

--- begin ---

MySQL Error Occured
1064: You have an error in your SQL syntax; check the manual that corresponds 
to your MySQL server version for the right syntax to use near 'Set-Cookie' at 
line 2

QUERY = SELECT cc3_CubeCart_options_bot.option_id, 
cc3_CubeCart_options_bot.value_id, option_price, option_symbol, assign_id FROM 
`cc3_CubeCart_options_bot` INNER JOIN `cc3_CubeCart_options_mid` ON 
cc3_CubeCart_options_mid.value_id = cc3_CubeCart_options_bot.value_id INNER 
JOIN `cc3_CubeCart_options_top` ON cc3_CubeCart_options_bot.option_id = 
cc3_CubeCart_options_top.option_id WHERE assign_id = Set-Cookie


--- end ---

To solve this vulnerability, the variable $option should be sanitized with 
mySQLSafe in all include files.

John Martinelli
john@martinelli.com

RedLevel Security
http://www.RedLevel.org

May 21st, 2007