Shopweezle 2.0 multiple vuln.
###############################################
Vuln. discovered by : r0t
Date: 9 april 2006
vendor:http://shopweezle.de/
affected versions:
ShopWeezle PERSONAL
ShopWeezle PROFESSIONAL
ShopWeezle PROFESSIONAL+
orginal advisory:
http://pridels.blogspot.com/2006/04/shopweezle-20-multiple-vuln.html
###############################################
Vuln. description:
Shopweezle contains a flaws that allows a remote sql injection
attacks.Inputpassed to the "itemID","brandID","album" isn't properly
sanitised before
being used in a SQL query. This can be exploited to manipulate SQL queries
by injecting arbitrary SQL code.
examples:
/login.php?caller=xlink&url=detail.php&itemID=1[SQL]
/index.php?x=0&itemgr=1[SQL]
/index.php?caller=xlink&url=brand.php&brandID=1[SQL]
/memo.php?itemID=1[SQL]
/index.php?x=0&caller=xlink&url=gallery.php&album=1[SQL]
An attacker can get full install path by testing SQL attack vuln.
Input passed to the "url" parameter in "index.php" isn't properly verified
before being used to include files. This can be exploited to include
arbitrary files from local resources.
###############################################
Solution:
Edit the source code to ensure that input is properly sanitised.
###############################################
More information @ unsecured-systems.com/forum/