89 lines
No EOL
2.6 KiB
Text
89 lines
No EOL
2.6 KiB
Text
##############################################################################
|
|
#
|
|
# Title : NetArt Media iBoutique SQL Injection Vulnerability
|
|
# Author : Antu Sanadi SecPod Technologies (www.secpod.com)
|
|
# Vendor : http://www.netartmedia.net/
|
|
# Advisory : http://secpod.org/blog/?p=510
|
|
# : http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt
|
|
# Software : NetArt Media iBoutique Version 4.0
|
|
# Date : 29/06/2012
|
|
#
|
|
##############################################################################
|
|
|
|
SecPod ID: 1044 02/02/2012 Issue Discovered
|
|
19/06/2012 Vendor Notified
|
|
No Response from vendor
|
|
18/07/2012 Advisory Released
|
|
|
|
Class: SQL Injection Severity: High
|
|
|
|
|
|
Overview:
|
|
---------
|
|
NetArt Media iBoutique SQL Injection Vulnerability.
|
|
|
|
|
|
Technical Description:
|
|
----------------------
|
|
An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails
|
|
to sanitise user-supplied input.
|
|
|
|
Input passed via the 'key' parameter to '/index.php' page is not properly
|
|
verified before being used in a SQL query. This can be exploited to
|
|
manipulate SQL queries by injecting arbitrary SQL code. This may allow an
|
|
unauthenticated attacker to launch further attacks.
|
|
|
|
These vulnerability have been tested on NetArt Media iBoutique v4.0, Other
|
|
versions may also be affected.
|
|
|
|
|
|
Impact:
|
|
--------
|
|
Successful exploitation could allow an attacker to manipulate SQL queries by
|
|
injecting arbitrary SQL code.
|
|
|
|
|
|
Affected Software:
|
|
------------------
|
|
NetArt Media iBoutique v4.0
|
|
|
|
|
|
Tested on,
|
|
NetArt Media iBoutique v4.0
|
|
|
|
|
|
References:
|
|
-----------
|
|
http://secpod.org/blog/?p=510
|
|
http://www.netartmedia.net/iboutique
|
|
http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt
|
|
|
|
|
|
Proof of Concept:
|
|
-----------------
|
|
http://www.example.com/iboutique/index.php?mod=products&key=%27
|
|
|
|
|
|
Solution:
|
|
---------
|
|
Fix not available
|
|
|
|
|
|
Risk Factor:
|
|
-------------
|
|
CVSS Score Report:
|
|
ACCESS_VECTOR = NETWORK
|
|
ACCESS_COMPLEXITY = LOW
|
|
AUTHENTICATION = NONE
|
|
CONFIDENTIALITY_IMPACT = PARTIAL
|
|
INTEGRITY_IMPACT = PARTIAL
|
|
AVAILABILITY_IMPACT = NONE
|
|
EXPLOITABILITY = PROOF_OF_CONCEPT
|
|
REMEDIATION_LEVEL = UNAVAILABLE
|
|
REPORT_CONFIDENCE = CONFIRMED
|
|
CVSS Base Score = 6.4 (High) (AV:N/AC:L/Au:N/C:N/I:P/A:N)
|
|
|
|
Credits:
|
|
--------
|
|
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
|
|
vulnerability. |