Cartweaver ColdFusion vuln.

Cartweaver ColdFusion vuln.

###############################################
Vuln. discovered by : r0t
Date: 25 april 2006
vendorlink:www.cartweaver.com
affected versions:2.16.11 and previous
orginal advisory:http://pridels.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html
###############################################

Vuln. Description:

1. SQL Injection vuln.

Cartweaver ColdFusion contains a flaw that allows a remote sql
injection attacks.Input passed to the "category" parameter in
"Results.cfm" isn't properly sanitised before being used in a SQL
query and Input passed to the "ProdID" parameter in "Details.cfm"
isn't properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

examples:

/Results.cfm?category=[sQL]
/Details.cfm?ProdID=[SQL]

2. Full Path Disclosure.

The problem is that it is possible to disclose the full path to the
installation by supplying an invalid
"secondary","PageNum_Results","category" parameter in "Results.cfm"
and "ProdID" parameter in "Details.cfm" .

examples:

/Results.cfm?PageNum_Results=&category=&secondary=[CODE]
/Results.cfm?PageNum_Results=[CODE]
/Details.cfm?ProdID=[CODE]
/Results.cfm?category=[CODE]

###############################################
Solution:
Edit the source code to ensure that input is properly sanitised.
###############################################
More information @ unsecured-systems.com/forum/