111 lines
3.7 KiB
Text
Executable file
111 lines
3.7 KiB
Text
Executable file
Title:
|
|
======
|
|
OSCommerce v3.0.2 - Persistent Cross Site Vulnerability
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-02-02
|
|
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
407
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
osCommerce is the leading Open Source online shop e-commerce solution that is available for free under the
|
|
GNU General Public License. It features a rich set of out-of-the-box online shopping cart functionality that
|
|
allows store owners to setup, run, and maintain their online stores with minimum effort and with no costs,
|
|
license fees, or limitations involved.
|
|
The goal of the osCommerce project is to continually evolve by attracting a community that supports the ongoing
|
|
development of the project at its core level and extensively through contributions to provide additional
|
|
functionality to the already existing rich feature set.
|
|
Everything you need to get started in selling physical and digital goods over the internet, from the Catalog frontend
|
|
that is presented to your customers, to the Administration Tool backend that completely handles your products,
|
|
customers, orders, and online store data.
|
|
|
|
(Copy of the Vendor Homepage: http://www.opensourcecms.com/scripts/details.php?scriptid=94&name=osCommerce)
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
Vulnerability-Lab Team (F0x) discovered a persistent Cross Site Scripting Vulnerability on the OSCommerce Shop Software.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-02-02: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Medium
|
|
|
|
|
|
Details:
|
|
========
|
|
Multiple persistant cross site vulnerabilities are detected on the OSCommerce v3.0.2.
|
|
The bug allows remote attacker to implement malicious script code on the application side.
|
|
Successful exploitation of the vulnerability allows an attacker to manipulate specific modules & can
|
|
lead to session hijacking (user/mod/admin).
|
|
|
|
Vulnerable Module(s):
|
|
[+]index.php?Cart
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The vulnerability can be exploited by local low privileged user account with required medium user inter action. For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
"'><img src=vul onerror=alert('vulnerabilitylab')> in the "front" field of the shirt module.
|
|
|
|
Output:
|
|
Size: Medium<br/>- Front: "'><img src=vul onerror=alert('vulnerabilitylab')>
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The security risk of the persistent vulnerability is estimated as medium.
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Research Laboratory - Alexander Fuchs (F0x23)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
|
|
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
|
|
other media, are reserved by Vulnerability-Lab or its suppliers.
|
|
|
|
Copyright ? 2012|Vulnerability-Lab
|
|
|
|
|
|
--
|
|
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
|
|
Contact: admin@vulnerability-lab.com or support@vulnerability-lab.com
|
|
|
|
|