('binary' encoding is not supported, stored as-is) +/--------\-------- ALPER Research Labs ------/--------/+ +/---------\------- Security Advisory -----/---------/+ +/----------\------ ID: ARL03-A16 ----/----------/+ +/-----------\----- salperat_private ---/-----------/+ Advisory Information -------------------- Name : Multiple Security Issues in phPay Software Package : phPay Vendor Homepage : http://phpay.sourceforge.net/ Vulnerable Versions: v2.02 and possibly older versions Platforms : OS Independent, PHP & MySQL Vulnerability Type : Input Validation Error Vendor Contacted : 20/02/2003 Vendor Replied : 20/02/2003 Prior Problems : N/A Current Version : v2.02.1 (problem fixed) Summary ------- phPay is an ecommerce, webshop and catalogue system for PHP4 &MySQL. It supports several languages and includes many functions for an online shopping area. Multiple path disclosure, information leakage and a Cross Site Scripting problem exist within "phPay v2.02". Details ------- 1. Cross Site Scripting vulnerability in search.php Example: http://[TARGET]/search.php?sess=your_session_id&lookfor=<script>alert (document.cookie)</script> 2. Path disclosure vulnerability, when a non-existent language is selected. Example: http://[TARGET]/login.php? sess=your_session_id&abt=&new_lang=99999&caller=navlang Output: >Fatal error: Failed opening required 'lang/.inc.php' >(include_path='.:/usr/share/php') in /home/web/html/phpay/lib.inc.php on >line 10 3. Path disclosure in start.php when pointing to a non existent file, this might also allow inclusion of arbitrary remote files. Example: http://[TARGET]/start.php?config=alper.inc.php Output: >Fatal error: Failed opening required './alper.inc.php' >(include_path='.:/usr/share/php') in /home/web/html/phpay/start.php on >line 17 4. You may stop by and watch the phpinfo(); for the site in /admin/phpinfo.php 5. Path disclosure in /doc/addon-index.php (because of an extra ../ in the include path). 6. Several other path disclosure vulnerabilities when scripts and include files are directly called. Examples: detail.php, fpass.php, header.inc.php, main.php, nav.php, pay.php, payed.php, publicpay.inc.php, reguser.php, search.php, server.php, view_cart.php, lib.inc.php, show_size.inc.php, limit.navi.inc.php, mailer.inc.php, show_cart.inc.php, stats.php, show_color.inc.php, show_content.inc.php, show_item_0.inc.php, show_item_1.inc.php, show_item_x.inc.php, show_item_2.inc.php 7. Some more path disclosure vulnerabilities in the "admin" directory. Solution -------- A new version which addresses the listed vulnerabilities has been released. Downloadable from; http://sourceforge.net/projects/phpay Credits ------- Discovered on 20, February, 2003 by Ahmet Sabri ALPER <salperat_private> ALPER Research Labs. The ALPER Research Labs. [ARL] workers are freelancer security professionals and WhiteHat hackers. The ARL workers are available for hiring for legal jobs. The ARL also supports Open Software Community, by detecting possible security issues in GPL or any other Public Licensed product. References ---------- Product Web Page: http://phpay.sourceforge.net/ Olympos: http://www.olympos.org/
This archive was generated by hypermail 2b30 : Wed Apr 09 2003 - 21:08:34 PDT