ProductCart Shopping Cart Input Validation Bug Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1007066
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Updated: Jul 3 2003
|
Original Entry Date: Jun 26 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Advisory: 1ndonesian Security Team
|
Version(s): 1.5 and prior versions
|
Description: 1ndonesian Security Team (1st) reported an input validation vulnerability in the ProductCart ASP-based shopping cart software. A remote user can conduct cross-site scripting attacks.
It is reported that the 'msg.asp' script does not filter HTML code from user-supplied input when generating error messages. A remote
user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by
the target user's browser. The code will originate from the site running the ProductCart software and will run in the security context
of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any,
associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
A demonstration exploit URL is provided:
http://[target_site_with_sopping_cart_installed]/msg.asp?message=<script>alert('1st')</script>
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
ProductCart software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: The vendor reports that versions 1.6 (released in January 2003) and later contain a fix. The latest version (v2) is not affected, according to the vendor.
|
Vendor URL: www.earlyimpact.com/productcart/index.asp (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: Bosen <mobile@bosen.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 26 Jun 2003 18:53:32 +0700
From: Bosen <mobile@bosen.net>
Subject: ProductCart XSS Vulnerability
|
1ndonesian Security Team (1st)
http://bosen.net/releases/
===========================================================================
Security Advisory
Advisory Name: ProductCart XSS Vulnerability
Release Date: 06/15/2003
Application: v2
Platform: Win32
Severity: Medium
BUG Type: XSS
Author: Bosen <mobile@bosen.net>
Discover by: Bosen <mobile@bosen.net>
Vendor Status: Notified, see response below.
Vendor URL: http://www.earlyimpact.com/productcart/
Reference: http://bosen.net/releases/
Overview:
ProductCart® is an ASP shopping cart that combines sophisticated ecommerce features
with time-saving store management tools and remarkable ease of use.
Details:
The bug lies on error msg handling in msg.asp. Which is allow attacker to inject XSS
script.
Exploits:
http://[target_site_with_sopping_cart_installed]/msg.asp?message=<script>alert('1st')</scrip
t>
Vendor Response:
Not Contacted. Not high risk.
Recommendation:
No recommendation for this.
1ndonesian Security Team (1st) Advisory:
http://bosen.net/releases/
About 1ndonesian Security Team:
1ndonesian Security Team, research and develop intelligent, advanced application
security assessment. Based in Indonesia, 1ndonesian Security Team offers best of
breed security consulting services, specialising in application, host and network
security assessments.
1st provides security information and patches for use by the entire 1st community.
This information is provided freely to all interested parties and may be
redistributed provided that it is not altered in any way, 1st is appropriately
credited and the document retains.
Bosen <mobile@bosen.net>
======================
Original document can be fount at http://bosen.net/releases/?id=36
-----------------------------------------------
This mail sent through http://webmail.bosen.net
|
|
