CubeCart 5.2.0 PHP Object Injection

2013-02-06T00:00:00
ID PACKETSTORM:120094
Type packetstorm
Reporter EgiX
Modified 2013-02-06T00:00:00

Description

                                        
                                            `-------------------------------------------------------------------------  
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection   
Vulnerability  
-------------------------------------------------------------------------  
  
  
[-] Software Link:  
  
http://www.cubecart.com/  
  
  
[-] Affected Versions:  
  
All versions from 5.0.0 to 5.2.0  
  
  
[-] Vulnerability Description:  
  
The vulnerable code is located in the Cubecart::_basket() method   
defined in the /classes/cubecart.class.php script:  
  
519. // Update shipping values  
520. if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {  
521. $GLOBALS['cart']->set('shipping',   
unserialize(base64url_decode($_POST['shipping'])));  
522. if (!isset($_POST['proceed'])) {  
523. httpredir(currentPage());  
524. }  
525. }  
  
User input passed through the $_POST['shipping'] parameter is not   
properly sanitized before being  
used in an unserialize() call at line 521. This can be exploited to   
inject an arbitrary object into  
the application scope. For e.g. the destructor method of the "Config"   
class could be abused:  
  
78. public function __destruct() {  
79. //Do we need to write to the db  
80. if ($this->_write_db) {  
81. $this->_writeDB();  
82. }  
83. }  
  
By sending a specially crafted serialized "Config" object, an attacker   
might be able to change the  
application configuration settings with arbitrary values, and this can   
lead to make the application  
vulnerable to malicious attacks such as Cross-Site Scripting, SQL   
Injection or Denial of Service.  
  
  
[-] Solution:  
  
Upgrade to version 5.2.1 or higher.  
  
  
[-] Disclosure Timeline:  
  
[27/01/2013] - Issue reported to   
http://bugs.cubecart.com/view.php?id=511  
[31/01/2013] - Version 5.2.1 released:   
http://forums.cubecart.com/?showtopic=47026  
[31/01/2013] - CVE number requested  
[04/02/2013] - CVE number assigned  
[06/02/2013] - Public disclosure  
  
  
[-] CVE Reference:  
  
The Common Vulnerabilities and Exposures project (cve.mitre.org)  
has assigned the name CVE-2013-1465 to this vulnerability.  
  
  
[-] Credits:  
  
Vulnerability discovered by Egidio Romano.  
  
  
[-] Original Advisory:  
  
http://karmainsecurity.com/KIS-2013-02  
`