Team Asylum Security Copyright (c) 1999 By CyberSpace 2000 http://www.team-asylum.com Source: Dave M. (davemat_private) Advisory Date: 09/16/1999 Affected -------- All known released versions of the iHTML Merchant for Unix/Windows 95/98/NT. Product Description ------------------- iHTML Merchant, written by Inline Internet Systems Inc., is an e-commerce solution programmed in iHTML which allows complicated web programming tasks to be done by anyone with basic knowledge of HTML and their web server of choice. Over 2,700 online merchants run iHTML Merchant. In turn, they can run dozens more stores off that single product. For more details about this product visit, http://www.ihtmlmerchant.com or see Inline's site at: http://www.inline.net. Vulnerability Summary --------------------- Team Asylum has discovered a vulnerability that exists in iHTML Merchant which would allow a malicious hacker to (at the very least) view the protected files in the website's administrative section, giving the attacker the ability to view credit card information. If the iHTML Merchant is being run on Windows 95/98/NT the vulnerability is much more severe. The vulnerability exists in how iHTML Merchant parses code. The attacker could: 1) Delete any file on the server 2) Write a file to any folder on the server. 3) Upload a trojan. 4) Steal credit card numbers, and other hidden information. If the iHTML Merchant is being run on UNIX, the possibility exists that the web site could be altered. These findings reflect the default settings for 95/98/NT and iHTML Merchant. Fix --- Below is a temporary fix that can be integrated with iHTML Merchant. <!--- http://www.team-asylum.com --> <iEQ name="brac" value=<iSTRIN SRC=":email" DST="<">> <iIF NOTCOND=<iSTRNICMP SRC=:brac DST="0">> For security reasons, your message was not sent.<br>Please verify that you entered your email address correctly, by going <a href="javascript:history.back(1)">back</a><br> <iinclude name="template/footer.ihtml"> <iSTOP> </iIF> <!--- Fix by: Dave Meehan --> Final Notes ----------- This vulnerability exists because of the way the iHTML Merchant was written but is compounded by faulty NT security settings. Team Asylum has notified Inline Internet Systems but have received no response whatsoever.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:05:44 PDT