71 lines
No EOL
2.1 KiB
Text
71 lines
No EOL
2.1 KiB
Text
-------------------------------------------------------------------------
|
|
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability
|
|
-------------------------------------------------------------------------
|
|
|
|
|
|
[-] Software Link:
|
|
|
|
http://www.cubecart.com/
|
|
|
|
|
|
[-] Affected Versions:
|
|
|
|
All versions from 5.0.0 to 5.2.0
|
|
|
|
|
|
[-] Vulnerability Description:
|
|
|
|
The vulnerable code is located in the Cubecart::_basket() method defined in the /classes/cubecart.class.php script:
|
|
|
|
519. // Update shipping values
|
|
520. if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
|
|
521. $GLOBALS['cart']->set('shipping', unserialize(base64url_decode($_POST['shipping'])));
|
|
522. if (!isset($_POST['proceed'])) {
|
|
523. httpredir(currentPage());
|
|
524. }
|
|
525. }
|
|
|
|
User input passed through the $_POST['shipping'] parameter is not properly sanitized before being
|
|
used in an unserialize() call at line 521. This can be exploited to inject an arbitrary object into
|
|
the application scope. For e.g. the destructor method of the "Config" class could be abused:
|
|
|
|
78. public function __destruct() {
|
|
79. //Do we need to write to the db
|
|
80. if ($this->_write_db) {
|
|
81. $this->_writeDB();
|
|
82. }
|
|
83. }
|
|
|
|
By sending a specially crafted serialized "Config" object, an attacker might be able to change the
|
|
application configuration settings with arbitrary values, and this can lead to make the application
|
|
vulnerable to malicious attacks such as Cross-Site Scripting, SQL Injection or Denial of Service.
|
|
|
|
|
|
[-] Solution:
|
|
|
|
Upgrade to version 5.2.1 or higher.
|
|
|
|
|
|
[-] Disclosure Timeline:
|
|
|
|
[27/01/2013] - Issue reported to http://bugs.cubecart.com/view.php?id=511
|
|
[31/01/2013] - Version 5.2.1 released: http://forums.cubecart.com/?showtopic=47026
|
|
[31/01/2013] - CVE number requested
|
|
[04/02/2013] - CVE number assigned
|
|
[06/02/2013] - Public disclosure
|
|
|
|
|
|
[-] CVE Reference:
|
|
|
|
The Common Vulnerabilities and Exposures project (cve.mitre.org)
|
|
has assigned the name CVE-2013-1465 to this vulnerability.
|
|
|
|
|
|
[-] Credits:
|
|
|
|
Vulnerability discovered by Egidio Romano.
|
|
|
|
|
|
[-] Original Advisory:
|
|
|
|
http://karmainsecurity.com/KIS-2013-02 |