----------------------------------------------------------------------

Want to join the Secunia Security Team?

Secunia offers a position as a security specialist, where your daily
work involves reverse engineering of software and exploit code,
auditing of source code, and analysis of vulnerability reports.

http://secunia.com/secunia_security_specialist/

----------------------------------------------------------------------

TITLE:
iShopCart Buffer Overflow and Directory Traversal Vulnerabilities

SECUNIA ADVISORY ID:
SA20415

VERIFY ADVISORY:
http://secunia.com/advisories/20415/

CRITICAL:
Highly critical

IMPACT:
Exposure of system information, Exposure of sensitive information,
System access

WHERE:
>From remote

SOFTWARE:
iShopCart
http://secunia.com/product/10300/

DESCRIPTION:
K-sPecial has reported some vulnerabilities in iShopCart, which can
be exploited by malicious people to disclose potentially sensitive
information and compromise a vulnerable system.

1) A boundary error in the "vGetPost()" function when handling POST
requests can be exploited to cause a stack-based buffer overflow and
may allow arbitrary code execution.

2) A boundary error within the handling of the parameter string
received via a GET request can be exploited to cause a stack-based
buffer overflow and may allow arbitrary code execution.

3) An input validation error within the handling of filenames
received via GET requests can be exploited to disclose arbitrary
files accessible by the web server process via directory traversal
attacks.

SOLUTION:
The vulnerabilities will reportedly be fixed soon.

Filter malicious characters and character sequences in a proxy or
firewall with a URL filtering capabilities.

PROVIDED AND/OR DISCOVERED BY:
K-sPecial

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------