########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research & Penetration Testing Group
#
# Title: [CandyPress] eCommerce suite
# Vendor: http://www.candypress.com/
# Bugs: SQL Injection + XSS + Path Disclosure in CandyPress
# Vulnerable Version: 4.1.1.26
# Exploit: Available
# Fix Available: Yes!, Update to 4.1.1.27 (http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1) (There is a fast solution too)
###################################################################################

####################
- Description:
####################
The CandyPress eCommerce suite acts as the command center of your online store. Powerful and versatile, yet easy to use and intuitive, it enables you to easily manage and administrate your orders, product catalog, shipping rates, locations, product reviews, customers and much more.

####################
- Vulnerability:
####################
Remote user can see all databases fields (there are a lot of encrypted credit cards), also there are XSS and Path Disclosure bugs too.

####################
- Fast Solution :
####################
1- Rename "/Admin" and "/Ajax" directories.
2- Rename (or delete) dangerous files which are:
	/ajax/ajax_optInventory.asp
	/ajax/ajax_getBrands.asp
	/admin/utilities_ConfigHelp.asp
	/admin/SA_shipFedExMeter.asp
	
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com