August 28, 2000
With well over 300 websites using Cart32, it's rather shocking that the
big security hole that was reported by Bunny69 back in May still exists
in Cart32. Bunny69 reported this hole on May 22 to the SecurityFocus Bugtraq
security bugs list, and as of today, we have found Cart32 sites still
using this blatantly insecure product.
change the price of a product being sold using Cart32, on the page that
has the price, you simply save the HTML code on your hard drive, and edit
the source. For example, if an item is priced at $119.00 you remove the
9 and the price becomes $11.00.
security hole is so easy to exploit, that any transaction systems that
dump this information directly into a backend database without further
inspection may have already lost ample revenue dollars due to this exploit.
With so many security vulnerabilities being exposed and talked about in
the media, it is rather shocking that companies still don't perform due
diligence when it comes to security. Any company accepting financial transactions
over the Internet should have an outside security audit done so that they
can plug their security holes before their profitability gets plugged.
selling e-commerce products need to be held accountable by their customers
for selling products with such easy-to-exploit security holes. Customers
need to start being more insistent on security patches and start holding
Some of the various security integrators and consultants who can assist
some of these Cart32 customers and other e-commerce vendors include:
Consultant / Integrator
shopping carts commonly have similar vulnerabilities, and any site using
them should proceed with caution.