Security Point info@secpoint.com www.secpoint.com/advis.html Advisory #001 Title: Java Internet Shop Vulnerability Date: 31-05-00 Copyright (c) 2000 SECURITY POINT Contents: ========= I Disclaimer II Introduction III Description IV Fix V Contact VI Vulnerable sites VII Job Offers VIII Greetings I - Disclaimer: =============== This paper is for educational purpose only, Security Point will not be responsible for any damages whatsoever that have a connection with the information written in this paper. There are no warranties with regard to this information, any use of this information is at the user's own risk. II - Introduction: ================== We have found a vulnerability in a common internet Java shop, this bug enables the users to select the price of the merchandise by her/him self! We have found two versions of the program that generates these Java shops, a Danish one and an English one. The name of the Danish one is Shopexpress, and the English is Zilron StoreCreator, this bug will affect about 2500++ internet shops. III - Description: ================== Affected Software: Shop Express (DANISH VERSION) Zilron StoreCreator Version 3.0 and below (ENGLISH VERSION) Description of the bug This was tested with Internet Explorer 5.x and Netscape 4.x Point your browser to an affected site running either Shop Express or StoreCreator. Now go to the item you "want" to buy. Then before you press the add to basket you can change the value of the product ! Source c0de In Internet Explorer select "VIEW SOURCE" and search for the string "returnpath" it will tell two numbers which you insert at x1, x2 and then at x3 you insert the name of the product. Whatever you want the price to be you insert at x4 like 10.00 for 10 $. javascript:parent.ReturnPath(x1, x2);parent.AddRecord("x3",x4,1); now you take THIS line you just got and type that into your internet explorer PATH and press enter. Then you click BUY item and you get to the ORDER site where it says the new price. This can then be exploited if the shop is a computer store and a computer is $ 1000 and you fx make the price $ 899 and so on with lotsa products then it means it will be VERY complicated for the shop to sort it all out and there it needs a database with fixed price on all product :! Vict0r / Allan IV - Fix: ========= add merchandise to a "database" file, eg: item[0]=Hat price[0]=10 item[1]=Computer price[1]=9999 Both Shopexpress and Zilron are aware of this problem and should therefor have a fix out soon. V - Contact: ============ If you have further questions regarding this bug, then you can contact us at www.secpoint.com/advisories info@secpoint.com VI - Vulnerable sites: ====================== Here are the lists of sites running Shop Express and StoreCreator. We have not checked all the sites. So there will be no guarantee for all these sites to be vulnerable. But check your own site. StoreCreator Sites: http://www.zilron.com http://www.zilron.com/mall/morestores.html Shop Express Sites: http://www.shopexpress.dk/ http://www.shopexpress.dk/referencer.htm VII - Job Offers: =============== Security Point is seeking security enthusiasts with a vast experience in intrusion testing, firewall/IDS configuration and other security-related fields. For more information, please visit: http://www.secpoint.com/secjobs.html VIII - Greetings fly to: ======================= : SecurityFocus.com, ADM, Obecian, Skodbums_hangout, w00w00, cybk0red the Greek whore, n0sser .