CartWeaver SQL Injection holes

People should just stop using inline SQL and move to stored procedures abstracted in data access objects. I personally wouldn't hire or buy a product written so poorly.

- Cartweaver 2.17.11 update released -

This free incremental update is released to address a potential issue with erroneous values passed to a query in a URL variable. Cartweaver 2 CF has always used Custom Error handling to present benign error messages to the user should erroneous query string data be passed to a CFQuery. However, there is the potential of a developer/user disabling the custom error feature in order to see the complete CF Error information during the development and set up of a Cartweaver based site, and then mistakenly publishing the site to the live server with Enable Error Handling still disabled.

Due to ColdFusions elegant method of handling query string data, no real threat was present to the data stored in the database and due to the fact that Cartweaver does not store sensitive credit data, there was no chance of any customer financial data being compromised. However the error messages presented by ColdFusion in this sort of a query failure could reveal application data that may not be intended to be visible to the public  such as database table and field names. This update to Cartweaver corrects this issue by scrubbing the erroneous or mis-formatted query string values and presenting the user with either valid search results or a no product found style message for product details.

To avoid the potential of problems with erroneous or malicious query strings we recommend Cartweaver users apply this update to their sites. If an update is not possible we encourage users to make sure that the default Error Handling is turned on.

This update release is part of our on-going efforts to make Cartweaver the best choice in ecommerce solutions.

If you have any questions, please fill out our contact form at: http://www.cartweaver.com/contact/

Thank you.
Cartweaver Development Team.
www.cartweaver.com

I don't have access to CartWeaver, but I admit I was confused by their press release as well. Maybe they really did fix some bugs, but their press release tries to down play the original holes.

Just to clear up any confusion my previous post may have caused… We do fully understand what SQL Injection is, and fixed the problem immediately, and released an update with the necessary “params” set to block any attempts. We have since released V3 which is secured against SQL Injection attempts as well. Now the reason I brought up the custom error handling is, if you force an error and you are simply displaying the default CF error message, you end up exposing database structure and possibly you data source name. This is all information you do not want to make public. And in the case of individuals that are inclined to try a SQL Injection attack, why make their job easier by providing them the database information they need to do so. So like the news release stated… Users should have all updated, but for those who for whatever reason did not, they should at least make sure they don’t display database information if an error occurs. The truth of the matter, in a distributed application, people can still find this data by looking at other sites and other means… But at the least, you don’t want to make it easy to do so. This is a preventative measure, but it is NOT a solution. The solution is to update or upgrade, which is what we told all of our users in a customer email.

Hope this clears things up.

Thanks.

Lawrence Cramer
Cartweaver.com