--nextPart7385749.0hxfqM5XV0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Sunday 21 January 2007 13:45, saps.audit@gmail.com wrote:

> vendor site: http://fishcart.org/
> product :fish cart
> bug:injection sql
> risk : medium
>
> injection sql :
> /display.php?cartid=3D200701210157208&zid=3D1&lid=3 D1&olimit=3D5&cat=3D&k=
ey1=3D&nlst=3Dy&
>olst=3D'[sql]
>
> ( change the cartid value with yours )
> laurent gaffie
> http://s-a-p.ca/
> contact: saps.audit@gmail.com

The developers were never notified before this was posted. Had the poster=
=20
exercised this simple courtesy he would have found that this is not an SQL=
=20
injection error.

A perusal of the open source shows that the olst parameter used in the abov=
e=20
URL is never used in an SQL statement.

This was in fact a latent condition turned up by the 'nlst' and 'olst'=20
parameters being active simultaneously, a condition not normally seen in=20
=46ishCart. Artificially setting both active resulting in an inconsistent =
SQL=20
query and thus a reported SQL error. There was never an SQL injection erro=
r=20
here.

This is similar to the last erroneous FishCart SQL injection bug, bugtraq I=
D=20
13499 of May 4, 2005 reported by 'dcrab', in which an artificially=20
constructed URL not normally occuring in FishCart operation was posted. Th=
at=20
URL tripped a condition that resulted in an SQL error due to an inconsisten=
t=20
SQL statement, not an SQL injection error as reported. There never was an=
=20
SQL injection then. dcrab did not notify the developers in advance either.

=46ishCart has long filtered parameters to avoid SQL injection errors and=20
similar sorts of bugs. The hardening fix for the dcrab report was=20
immediately added to source when reported. The hardening fix for this repo=
rt=20
is now committed to CVS, and the impending 3.2 release will of course have=
=20
the fix as well.

=2D-=20

Michael Brennen
President, FishNet(R), Inc.
Professional Internet Services
972.669.0041

--nextPart7385749.0hxfqM5XV0
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.1 (GNU/Linux)

iD8DBQBFtTV1ZHW5VSn5SLMRApqbAJ9at9oge1+nqihByaCA5d kR5rstHwCeJBdf
BKYuTyU2swITZvBBnNjESG4=
=+OrO
-----END PGP SIGNATURE-----

--nextPart7385749.0hxfqM5XV0--