RCE in Zen Cart via Arbitrary File Inclusion

2015-11-25T00:00:00
ID HTB23282
Type htbridge
Reporter High-Tech Bridge
Modified 2015-11-26T00:00:00

Description

High-Tech Bridge Security Research Lab discovered critical vulnerability in a popular e-commerce software Zen Cart, which can be exploited by remote non-authenticated attackers to compromise vulnerable system. A remote unauthenticated attacker might be able to execute arbitrary PHP code on the target system, run arbitrary system commands, gain complete access to application's database and obtain information of all website users.

The vulnerability exists due to absence of filtration of directory traversal sequences in "act" HTTP GET parameter in "/ajax.php" script, when including local PHP files using 'require()' PHP function. A remote unauthenticated attacker can include and execute arbitrary PHP code on the target system with privileges of the web server.

A simple exploit below will include file "/tmp/file.php" and execute its content:

http://[host]/ajax.php?method=1&act=/../../../../tmp/file