accept no compromises

CubeCart 5.2.0 PHP Object Injection

CubeCart 5.2.0 PHP Object Injection
Posted Feb 6, 2013
Authored by EgiX

CubeCart versions 5.0.0 through 5.2.0 suffer from a PHP object injection vulnerability in cubecart.class.php.

tags | exploit, php
advisories | CVE-2013-1465
MD5 | cf98d3b5e35adc103e223f150bd1f6ab

CubeCart 5.2.0 PHP Object Injection

Change Mirror Download
-------------------------------------------------------------------------
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection
Vulnerability
-------------------------------------------------------------------------


[-] Software Link:

http://www.cubecart.com/


[-] Affected Versions:

All versions from 5.0.0 to 5.2.0


[-] Vulnerability Description:

The vulnerable code is located in the Cubecart::_basket() method
defined in the /classes/cubecart.class.php script:

519. // Update shipping values
520. if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
521. $GLOBALS['cart']->set('shipping',
unserialize(base64url_decode($_POST['shipping'])));
522. if (!isset($_POST['proceed'])) {
523. httpredir(currentPage());
524. }
525. }

User input passed through the $_POST['shipping'] parameter is not
properly sanitized before being
used in an unserialize() call at line 521. This can be exploited to
inject an arbitrary object into
the application scope. For e.g. the destructor method of the "Config"
class could be abused:

78. public function __destruct() {
79. //Do we need to write to the db
80. if ($this->_write_db) {
81. $this->_writeDB();
82. }
83. }

By sending a specially crafted serialized "Config" object, an attacker
might be able to change the
application configuration settings with arbitrary values, and this can
lead to make the application
vulnerable to malicious attacks such as Cross-Site Scripting, SQL
Injection or Denial of Service.


[-] Solution:

Upgrade to version 5.2.1 or higher.


[-] Disclosure Timeline:

[27/01/2013] - Issue reported to
http://bugs.cubecart.com/view.php?id=511
[31/01/2013] - Version 5.2.1 released:
http://forums.cubecart.com/?showtopic=47026
[31/01/2013] - CVE number requested
[04/02/2013] - CVE number assigned
[06/02/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1465 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-02

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    2 Files
  • 24
    Jul 24th
    19 Files
  • 25
    Jul 25th
    28 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close