logo Home

Untitled Document

Home > Archives Advisories > Articles


Untitled Document

Untitled Document

Multiple Security Issues in phPay
Date: 2003-04-10

Author : Ahmet Sabri ALPER <s_alper@hotmail.com>

+/--------\-------- ALPER Research Labs ------/--------/+
+/---------\------- Security Advisory -----/---------/+
+/----------\------ ID: ARL03-A16 ----/----------/+
+/-----------\----- salper@olympos.org ---/-----------/+


Advisory Information
--------------------
Name : Multiple Security Issues in phPay
Software Package : phPay
Vendor Homepage : http://phpay.sourceforge.net/
Vulnerable Versions: v2.02 and possibly older versions
Platforms : OS Independent, PHP & MySQL
Vulnerability Type : Input Validation Error
Vendor Contacted : 20/02/2003
Vendor Replied : 20/02/2003
Prior Problems : N/A
Current Version : v2.02.1 (problem fixed)


Summary
-------
phPay is an ecommerce, webshop and catalogue system for PHP4 &MySQL.
It supports several languages and includes many functions for an online
shopping area.

Multiple path disclosure, information leakage and a Cross Site Scripting
problem exist within "phPay v2.02".


Details
-------
1. Cross Site Scripting vulnerability in search.php
Example:
http://[TARGET]/search.php?sess=your_session_id&lookfor=<script>alert
(document.cookie)</script>


2. Path disclosure vulnerability, when a non-existent language is selected.
Example:
http://[TARGET]/login.php?
sess=your_session_id&abt=&new_lang=99999&caller=navlang
Output:
>Fatal error: Failed opening required 'lang/.inc.php'
>(include_path='.:/usr/share/php') in /home/web/html/phpay/lib.inc.php on
>line 10


3. Path disclosure in start.php when pointing to a non existent file, this
might also
allow inclusion of arbitrary remote files.
Example:
http://[TARGET]/start.php?config=alper.inc.php
Output:
>Fatal error: Failed opening required './alper.inc.php'
>(include_path='.:/usr/share/php') in /home/web/html/phpay/start.php on
>line 17


4. You may stop by and watch the phpinfo(); for the site in
/admin/phpinfo.php


5. Path disclosure in /doc/addon-index.php (because of an extra ../ in the
include path).


6. Several other path disclosure vulnerabilities when scripts and include
files are directly called.
Examples:
detail.php, fpass.php, header.inc.php, main.php, nav.php, pay.php,
payed.php, publicpay.inc.php, reguser.php, search.php, server.php,
view_cart.php, lib.inc.php, show_size.inc.php, limit.navi.inc.php,
mailer.inc.php, show_cart.inc.php, stats.php, show_color.inc.php,
show_content.inc.php, show_item_0.inc.php, show_item_1.inc.php,
show_item_x.inc.php, show_item_2.inc.php


7. Some more path disclosure vulnerabilities in the "admin" directory.


Solution
--------
A new version which addresses the listed vulnerabilities has been
released. Downloadable from;
http://sourceforge.net/projects/phpay


Credits
-------
Discovered on 20, February, 2003 by
Ahmet Sabri ALPER <salper@olympos.org>
ALPER Research Labs.

The ALPER Research Labs. [ARL] workers are freelancer
security professionals and WhiteHat hackers. The ARL
workers are available for hiring for legal jobs.
The ARL also supports Open Software Community, by detecting
possible security issues in GPL or any other Public Licensed
product.


References
----------
Product Web Page: http://phpay.sourceforge.net/
Olympos: http://www.olympos.org/



 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy