OXID eShop CE 4.9.7 Path Traversal / Privilege Escalation

`=== LSE Leading Security Experts GmbH - Security Advisory 2016-02-03 ===  
  
OXID eShop Path Traversal Vulnerability  
------------------------------------------------------------------------  
  
Affected Versions  
=================  
Community Edition 4.9.7  
  
Issue Overview  
==============  
Vulnerability Type: path traversal, privilege escalation  
Version: Tested in Community Edition 4.9.7  
Technical Risk: high  
Likelihood of Exploitation: medium  
Vendor: OXID eSales AG  
Vendor URL: https://www.oxid-esales.com  
Credits: LSE Leading Security Experts GmbH employee Tim Herres  
Advisory URL: https://www.lsexperts.de/advisories/lse-2016-02-03.txt  
Advisory Status: Public  
CVE-Number: NA  
CVE URL: NA  
OVE-ID:OVE-20160419-0002  
OVI-ID:OVI-2016-7988  
CWE-ID: CWE-22  
CVSS 2.0: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)  
  
  
  
Impact  
======  
A missing file path validation allows an authenticated user with permission  
to add or edit products to read any file on the file system without permissions.  
  
  
  
Issue Description  
=================  
While conducting an internal evaluation of the software, LSE Leading  
Security Experts GmbH discovered a path traversal vulnerability in the product  
downloads function. A user with permissions to change or add products may change  
the Downloads name to a local file (e.g. "../../../config.inc.php"). This may lead  
to a privilege escalation.  
  
  
  
  
Temporary Workaround and Fix  
============================  
Install latest update 4.9.8/5.2.8  
See http://wiki.oxidforge.org/Downloads/4.9.8_5.2.8  
  
  
Proof of Concept  
================  
Create a new product in the backend. In the "Downloads" tab set "name of the uploaded  
file" to "../../../config.inc.php". Go to the frontend and buy the related product.  
Move to "My account" and choose the download section. Download the file and enjoy  
full database credentials.  
  
History  
=======  
2016-02-05 Issue discovered  
2016-02-22 Vendor contacted  
2016-02-24 Vendor confirmed  
2016-05-03 Vendor released patch  
2016-05-03 Advisory release  
  
  
GPG Signature  
=============  
This advisory is signed with the GPG key of the  
LSE Leading Security Experts GmbH advisories team.  
The key can be downloaded here: https://www.lsexperts.de/advisories-key-99E3277C.asc  
  
  
`