Bonsai Information Security - Vulnerability Research

SQL Injection in CS-Cart

1. Advisory Information

Advisory ID: BONSAI-2009-0100
Date published: 2009-06-05
Vendors contacted: CS-Cart
Release mode: Coordinated release

2. Vulnerability Information

Class: SQL Injection
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: TBD

3. Software Description

CS-Cart is an "out of the box" ecommerce software solution with easy-to-use functionality that allows to start selling online immediately. Its feature set fits into businesses of any size, from a small single-product shop to a fully-featured online storefront [0].

4. Vulnerability Description

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

For additional information, please look at the references [1] and [2].

5. Vulnerable packages

Version <= 2.0.5

6. Non-vulnerable packages

CS-Cart developers informed us that all users should upgrade to the latest version of CS-Cart, (CS-Cart 2.0.6) which fixes this vulnerability. More information to be found here:
http://kb2.simtech/how-to-upgrade

7. Credits

This vulnerability was discovered by Ryan Dewhurst ( ryan -at- bonsai-sec.com ).

8. Technical Description

A SQL injection vulnerability was found in the reward_points.post.php script, more specifically in the $sort_order variable.

The vulnerability can be triggered by logging into CS-Cart and browsing to:

/index.php?dispatch=reward_points.userlog&result_ids=pagination_contents&sort_by=timestamp&sort_order='

Which will generate a syntax error in the database. The following is the corresponding piece of code:

reward_points.post.php:69
$userlog = db_get_array("SELECT change_id, action, timestamp, amount, reason FROM 
                        ?:reward_point_changes WHERE user_id = ?i ORDER BY $sort_by $sort_order
                         $limit", $user_id);

9. Report Timeline

2009-07-06:

2009-07-09:

2009-07-09:

10. References

[0] http://www.cs-cart.com/

[1] http://www.owasp.org/index.php/SQL_injection

[2] http://en.wikipedia.org/wiki/SQL_injection

11. About Bonsai

Bonsai is a company involved in providing professional computer information security services. Currently a sound growth company, since its foundation in early 2009 in Buenos Aires, Argentina, we are fully committed to quality service, and focused on our customers real needs.