Zen Follower
- Join Date:
- Jun 2009
- Posts:
- 187
- Plugin Contributions:
- 0
McAfee Secure Vulnerabilities found after upgrade
Zen Cart 1.3.9d
Database Patch Level: 1.3.9b
v1.3.9b [2010-05-09 18:31:30] (Version Update 1.3.8->1.3.9b)
v1.3.8 [2009-06-05 17:33:38] (Fresh Installation)
Server OS: Linux 2.6.18-164.10.1.el5PAE Database: MySQL 5.0.77-log
Server Date: 06/13/2010 09:55:18 Database Date: 06/13/2010 09:55:18
Server Up Time: 09:55:18 up 150 days, 21:14, 0 users, load average: 3.84, 3.91, 3.87 HTTP Server: Apache
PHP Version: 5.2.13 (Zend: 2.2.0) PHP Memory Limit: 32M PHP Safe Mode: Off
PHP File Uploads: On Max Size: 2M POST Max Size: 8M
Database Data Size: 67,135 kB
I do have mods installed but they were installed quite a while back. This occurred on June 9th. Thanks for any input.
I hope I put this in the proper forum. This happened on June9th after upgrading the the latest release, now McAfee won't display their graphic as this is a higher security alert.
Vulnerability MySQL Database Error Disclosure Vulnerability
Port 80/tcp
Scan Date 12-JUN-2010 23:15
I click on their alert and "response"
<div class="systemError">1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ';",)`' or p2c.categories_id='x';",)`') limit 1' at line 5<br />in:<br />[select p2c.categories_id, p.master_categories_id from products p, products_to_categories p2c where p.products_id = '303' and p.products_id = p2c.products_id and (p.master_categories_id = 'x';",)`' or p2c.categories_id='x';",)`') limit 1]<br /></div>Their solution
General Solution
THE SINGLE BEST WAY TO FIX THIS VULNERABILITY IS TO IDENTIFY THE ACCEPTABLE INPUT FOR EACH FORM PARAMETER AND REJECT INPUT THAT DOES NOT MEET THAT CRITERIA.
The following is an acceptable solution however it is not optimal.
Implement content parsing on data input fields including URL parameters.
Remove the following characters from any user or dynamic database input: (examples in VBScript)
' (escape the single quote) input = replace( input, "'", "''" )
" (double quote) input = replace( input, """", "" )
) (close parenthesis) input = replace( input, ")", "" )
( (open parenthesis) input = replace( input, "(", "" )
; (semi-colon) input = replace( input, ";", "" )
- (dash) input = replace( input, "-", "" )
| (pipe) input = replace( input, "|", "" )
On text input it is recommended to append quotes around the user supplied input.
