Security Point 
    info@secpoint.com
www.secpoint.com/advis.html


Advisory #001
Title: Java Internet Shop Vulnerability
Date: 31-05-00


      Copyright (c) 2000 SECURITY POINT

Contents:
=========

  I  Disclaimer
  II  Introduction
  III  Description
  IV  Fix
  V  Contact
  VI  Vulnerable sites
        VII     Job Offers
  VIII    Greetings

I - Disclaimer:
===============

This paper is for educational purpose only, Security Point will not be
responsible for any damages whatsoever that have a connection with the
information written in this paper. There are no warranties with regard 
to this information, any use of this information is at the user's own risk.



II - Introduction:
==================

We have found a vulnerability in a common internet Java shop, this bug 
enables the users to select the price of the merchandise by her/him self! 
We have found two versions of the program that generates these Java shops, a 
Danish one and an English one. The name of the Danish one is Shopexpress, and 
the English is Zilron StoreCreator, this bug will affect about 2500++ internet 
shops.

III - Description:
==================

Affected Software:

Shop Express (DANISH VERSION)
Zilron StoreCreator Version 3.0 and below (ENGLISH VERSION)

Description of the bug

This was tested with Internet Explorer 5.x and Netscape 4.x

Point your browser to an affected site running either Shop Express or 
StoreCreator. Now go to the item you "want" to buy. Then before you press the 
add to basket you can change the value of the product !

Source c0de
In Internet Explorer select "VIEW SOURCE" and search for the string "returnpath"
it will tell two numbers which you insert at x1, x2 and then at x3 you insert the 
name of the product. Whatever you want the price to be you insert at x4 like 
10.00 for 10 $.

javascript:parent.ReturnPath(x1, x2);parent.AddRecord("x3",x4,1);

now you take THIS line you just got and type that into your internet explorer 
PATH and press enter. Then you click BUY item and you get to the ORDER site 
where it says the new price.

This can then be exploited if the shop is a computer store and a computer
is $ 1000 and you fx make the price $ 899 and so on with lotsa products   
then it means it will be VERY complicated for the shop to sort it all out
and there it needs a database with fixed price on all product :!


Vict0r / Allan

IV - Fix:
=========

add merchandise to a "database" file, eg:

item[0]=Hat
price[0]=10
item[1]=Computer
price[1]=9999

Both Shopexpress and Zilron are aware of this problem and should therefor have
a fix out soon.


V - Contact:
============

If you have further questions regarding this bug, then you can contact us at 
www.secpoint.com/advisories
info@secpoint.com


VI - Vulnerable sites:
======================

Here are the lists of sites running Shop Express and StoreCreator.
We have not checked all the sites. So there will be no guarantee for all 
these sites to be vulnerable. But check your own site.

StoreCreator Sites:
http://www.zilron.com
http://www.zilron.com/mall/morestores.html

Shop Express Sites:
http://www.shopexpress.dk/
http://www.shopexpress.dk/referencer.htm


VII - Job Offers:
===============

Security Point is seeking security enthusiasts with a vast experience
in intrusion testing, firewall/IDS configuration and other
security-related fields. For more information, please visit:

http://www.secpoint.com/secjobs.html


VIII - Greetings fly to:
=======================
: SecurityFocus.com, ADM, Obecian, Skodbums_hangout, w00w00, cybk0red the Greek whore, n0sser .