bugtraq - Vulnerability - cpCommerce

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 25 May 2007 14:04:18 -0000
From: jadoba@...oba.net
To: bugtraq@...urityfocus.com
Subject: Vulnerability - cpCommerce - XSS

cpcommerce is a FOSS php-based e-commerce (shopping cart) web application. 

Exploit: Javascript placed inside a user's "Full Name:" field will not be stripped - it will be added to the database 'as-is' as long as it has no quotations in the string. When the admin goes to the clients view page, the javascript is executed as the rogue client's name appears. 

Gravity: The attacker can potentially fetch the admin's cookie or do a vast amount of other things.

Complication: This is very trivial to reproduce. Anyone with experience coding javascript can presently take advantage of the admin account of any unpatched cpcommerce shopping cart.

This is only one aspect of this cross-site scripting vulnerability. I still have yet to test other parts of my site which have user-inputted information such as product reviews and order forms.

I tested this with 1.1.0 (the latest version) - the OS is debian etch running apache2, php5 and mysql5. I suspect that earlier versions of cpcommerce are most likely also vulnerable.