SENKED-2009-0001 - Atlantic SimpleCaddy Shopping Cart Price Manipulation

senked security advisory
http://www.senked.com/ 

Date Published: 2009-07-01

Last Update: 2009-07-01

Advisory ID: SENKED-2009-0001

Bugtraq ID: none

CVE Name: none

Title: Atlanticintelligence SimpleCaddy Shoopuing Cart Price Manipulation

Class: Parameter Manipulation

Remotely Exploitable: Yes

Locally Exploitable: No

Advisory URL: http://www.senked.com/index.php/seguranca/advisories/58-advisory-senked-2009-0001 

Vendors contacted: The vendor has been contacted and by the time of this advisory, a patch was not yet produced.

Vulnerable Packages: All versions < 1.7

Credits:
This vulnerability was found and researched by Domingos Bruges from senked Security.

Product Overview:
SimpleCaddy aims to be a simple yet powerful shopping cart solution for Joomla. It uses standard content to show the products' details and a small plugin on that page to present the "Add to Cart" functionality.

Technical Description - Exploit / Concept Code:
The vulnerability is due to improper handling of user input parameters. The product catalog typically consists of a product code, a product description, pricing and other information. When a customer selects a product from the catalog, he places it in his shopping cart. Weak integration of the product catalog and the shopping cart leads to security vulnerabilities.
This Product allows a user to manipulate the price while selecting the product quantity. This will conduct in users buying products at reduced prices.

Vulnerability Exploitation:
In this case, quantity validation is an important issue. There's correct validation of negative quantity inputs, but what happens if the customer enter a fractional quantity?
To exploit this vulnerability the user just has to enter a fractional quantity. If an user inputs 0,3 as quantity, the price will be recalculated as (standard price) x (quantity). This will lead the user to buy the product by 30% of its original price.

Resolution:
A well-implemented shopping cart application interfaces with the back-end product information database. Then parameters such as prices are derived from the database instead of relying on HTML form fields or any user inputs being passed back and forth. Also validations should not be done on the user side, allowing him to manipulate all possible validations.