Cosmoshop pwd.cgi htaccess Creation

`*) Author:  
l0om ( http://l0om.org )  
  
*) Date:  
10.03.2014  
  
*) Overview:  
Cosmoshop is installed with a lot of admin scripts which should be only accessible as the logged-in admin. The script "pwd.cgi" is not protected and will create a .htaccess file for the admin-directory with any content. This may lead to phishing-attacks and more.  
  
*) affected products  
Probably all Cosmoshop-Versions > 8.0  
  
*) Details:  
Cosmoshop is another webshop-solution written in perl developed for the german market. The "pwd.cgi" file creates a .htaccess file to provide .htaccess protection for the whole admin directory. The file is located in the same directory as the login-script. To check if you are vulnerable simply get to the admin-directory as the not logged-in admin and open the "pwd.cgi" file ( e.g. "/cosmoshop/cgi-bin/admin/pwd.cgi"). The user has to supply in a form-element a username and a password. The script will automaticly create .htaccess, .htpasswd and .htgroup.   
  
The script includes something like:  
[...]  
print HT "<Limit GET>\n";  
print HT "require group $user\n";  
print HT "</Limit>\n";  
[...]  
  
The $user is supplied by the user and there is no character-filter. Therefore everyone can create a .htaccess file in the admin-directory with any content. The corrupted arguments may be delivered by a HTML file (only thing to regard is you cannot supply newline-characters by input-fields but using a textarea does the trick) or simply by curl.   
  
As an attacker can edit the .htaccess file however he wants there may be a lot of possible attacks. For example a phishing attack can be constructed. An attacker can use the .htaccess "Redirect" keyword and redirect the user to a fake login page.  
  
Furthermore i would like to emphraze the bad idea of just limiting GET requests. If a shop-owner protects his admin-directory with this automaticly created .htaccess file an attacker may still use POST requests to enter the directory.  
  
*) Workaround:  
+ Delete the pwd.cgi file  
+ Set the file permissions to not-accessible ("chmod 000 pwd.cgi")  
  
  
`