PCI Issue

Hi,

I am reaching out to you because my PCI guy is concerned that he uncovered an SQL injection vulnerability in Zen Cart.

All carts hosted with us previously passed, but this time we have this....

IP Address: 70.84.189.213
Vulnerability: CGI Generic SQL Injection Vulnerability
Category: http (80/tcp)
Security Level: 5
Synopsis :
A web application is potentially vulnerable to SQL injection.
Description :
By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying database. This error
suggests that the CGI is affected by a SQL injection vulnerability. An attacker may exploit this flaw to bypass
authentication, read confidential data, modify the remote database, or even take control of the remote operating system.
/stafftshirts-c-169.html?sort='%2Bconvert(varchar%2C0x7b5d)%2B'
See also http://en.wikipedia.org/wiki/SQL_injection
See also http://www.securiteam.com/securityreviews/5DP0N1P76E.html
See also http://www.securitydocs.com/library/2651
Solution: Modify the relevant CGIs so that they properly escape arguments.
BugTraq Reference: NA
I originally assumed was USEO, but am able to produce incorrect responses from USEO, SSEO and standard Zen Cart urls tested over several servers.

He also said the single quote appears to be the hot key.

Any ideas? All of the carts checked by me are fully patched.

Thanks a bunch

~Melanie

Confirmed.

While the rogue content does NOT pose any actual SQL Injection Vulnerability, it DOES throw an error on-screen.

The root cause is some sloppy coding.

The simplest fix, and thus the easiest way to patch it in v1.3.x, is to apply the PCI patch updated here:
http://www.zen-cart.com/forum/showthread.php?p=809045

... namely the 3 lines added to deal with the $_GET['sort'] parameter.

The sloppy coding will be fixed for future releases.