[转载]MetaCart e-Shop多个脚本注入漏洞

信息来源：www.securiteam.com

Summary
MetaCart e-Shop is a "shopping cart application for small businesses and support MSSQL, MS Access and MySQL". The MetaCart e-Shop product has been found to contain multiple vulnerabilities ranging from cross site scripting to SQL injection attacks.

Credit:
The information has been provided by dedi dwianto.
The original article can be found at: http://echo.or.id/adv/adv13-theday-2005.txt

Details
Cross-Site Scripting (XSS)
By issuing a URL such as the following:
http://[url]/mcartlite/productsByCategory.asp?intCatalogID=1 &strCatalog_NAME=<script>alert(&#39;test&#39;)</script>
An attacker can cause the remote host to include arbitrary HTML and/or JavaScript.

Vulnerable code in productsByCategory.asp:
strCatalog_name = Request.QueryString("strCatalog_NAME")
...
...
strParam = Response.Write (rsCatalog("catalogID")) &strCatalog_NAME=Response.Write
(Server.URLEncode(rsCatalog("catalogName"))) &rsCatalog("catalogName")

SQL Injection
By issuing any of the following URLs:
http://[url]/mcartlite/productsByCategory.asp?strSubCatalogID=2&#39;(Sql Injection)
http://[url]/mcartlite/product.asp?intProdID=1&#39;(SQL Injection)
An attacker can cause the remote host to include arbitrary SQL statements into the product&#39;s existing SQL statements.

Vulnerable code in productsByCategory.asp:
intCatalogID = Request.QueryString("intCatalogID")
...
...
&#39; Build SQL String using the parameters
strSQL = "SELECT productID,productName,productPrice FROM products WHERE catalogID = &#39;"&strParam&"&#39;"

Vulnerable code in product.asp:
intProdID = Request.QueryString("intProdID")
...
...
Set rsProdInfo = Conn.Execute("SELECT * FROM " & _
"products where productID="&intProdID)
if rsProdInfo.EOF then
Response.Write "Product Number " & intProdID & _
" does not exist."

Solution:
For productsByCategory.asp do the following:
* Find:
intCatalogID = Request.QueryString("intCatalogID")
After it add:
intCatalogID = Replace(intCatalogID,"&#39;","")

* Find:
strCatalog_name = Request.QueryString("strCatalog_NAME")
After it add:
strCatalog_name = Replace(strCatalog_NAME,"<","")

For products.asp do the following:
* Find:
intProdID = Request.QueryString("intProdID")
After it add:
intProdID = Replace(intProdID,"&#39;","")