bugtraq - [KIS-2013-02] CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <d120ad664c7b22557082c9203b099b39@karmainsecurity.com>
Date: Wed, 06 Feb 2013 14:05:01 +0100
From: Egidio Romano <research@...mainsecurity.com>
To: <bugtraq@...urityfocus.com>
Subject: [KIS-2013-02] CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability

-------------------------------------------------------------------------
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection 
Vulnerability
-------------------------------------------------------------------------

[-] Software Link:

http://www.cubecart.com/

[-] Affected Versions:

All versions from 5.0.0 to 5.2.0

[-] Vulnerability Description:

The vulnerable code is located in the Cubecart::_basket() method 
defined in the /classes/cubecart.class.php script:

519.	// Update shipping values
520.	if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
521.	    $GLOBALS['cart']->set('shipping', 
unserialize(base64url_decode($_POST['shipping'])));
522.	    if (!isset($_POST['proceed'])) {
523.	        httpredir(currentPage());
524.	    }
525.	}

User input passed through the $_POST['shipping'] parameter is not 
properly sanitized before being
used in an unserialize() call at line 521. This can be exploited to 
inject an arbitrary object into
the application scope. For e.g. the destructor method of the "Config" 
class could be abused:

78.	public function __destruct() {
79.	    //Do we need to write to the db
80.	    if ($this->_write_db) {
81.	        $this->_writeDB();
82.	    }
83.	}

By sending a specially crafted serialized "Config" object, an attacker 
might be able to change the
application configuration settings with arbitrary values, and this can 
lead to make the application
vulnerable to malicious attacks such as Cross-Site Scripting, SQL 
Injection or Denial of Service.

[-] Solution:

Upgrade to version 5.2.1 or higher.

[-] Disclosure Timeline:

[27/01/2013] - Issue reported to 
http://bugs.cubecart.com/view.php?id=511
[31/01/2013] - Version 5.2.1 released: 
http://forums.cubecart.com/?showtopic=47026
[31/01/2013] - CVE number requested
[04/02/2013] - CVE number assigned
[06/02/2013] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1465 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-02