Atlantic SimpleCaddy Shopping Cart Price Manipulation

[domingos.bruges@xxxxxxxxxx]

SENKED-2009-0001 - Atlantic SimpleCaddy Shopping Cart Price Manipulation

senked security advisory
http://www.senked.com/

Date Published: 2009-07-01

Last Update: 2009-07-01

Advisory ID: SENKED-2009-0001

Bugtraq ID: none

CVE Name: none

Title: Atlanticintelligence SimpleCaddy Shoopuing Cart Price Manipulation

Class: Parameter Manipulation

Remotely Exploitable: Yes

Locally Exploitable: No

Advisory URL: 
http://www.senked.com/index.php/seguranca/advisories/58-advisory-senked-2009-0001

Vendors contacted: The vendor has been contacted and by the time of this 
advisory, a patch was not yet produced.

Vulnerable Packages: All versions < 1.7

Credits:
This vulnerability was found and researched by Domingos Bruges from senked 
Security.

Product Overview:
SimpleCaddy aims to be a simple yet powerful shopping cart solution for Joomla. 
It uses standard content to show the products' details and a small plugin on 
that page to present the "Add to Cart" functionality.

Technical Description - Exploit / Concept Code:
The vulnerability is due to improper handling of user input parameters. The 
product catalog typically consists of a product code, a product description, 
pricing and other information. When a customer selects a product from the 
catalog, he places it in his shopping cart. Weak integration of the product 
catalog and the shopping cart leads to security vulnerabilities.
This Product allows a user to manipulate the price while selecting the product 
quantity. This will conduct in users buying products at reduced prices.

Vulnerability Exploitation:
In this case, quantity validation is an important issue. There's correct 
validation of negative quantity inputs, but what happens if the customer enter 
a fractional quantity?
To exploit this vulnerability the user just has to enter a fractional quantity. 
If an user inputs 0,3 as quantity, the price will be recalculated as (standard 
price) x (quantity). This will lead the user to buy the product by 30% of its 
original price.

Resolution:
A well-implemented shopping cart application interfaces with the back-end 
product information database. Then parameters such as prices are derived from 
the database instead of relying on HTML form fields or any user inputs being 
passed back and forth. Also validations should not be done on the user side, 
allowing him to manipulate all possible validations.