[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CubeCart 5.x | Cross Site Request Forgery (CSRF) Vulnerability
- To: full-disclosure <full-disclosure@xxxxxxxxxxxxxxxxx>, bugtraq <bugtraq@xxxxxxxxxxxxxxxxx>, secalert@xxxxxxxxxxxxxxxxxx, bugs@xxxxxxxxxxxxxxxxxxx, vuln <vuln@xxxxxxxxxxx>, vuln@xxxxxxxxxxxxxxxx, news@xxxxxxxxxxxxxx, moderators@xxxxxxxxx, submissions@xxxxxxxxxxxxxxxxxxxxxxx, submit@xxxxxxxxxxxxxx
- Subject: CubeCart 5.x | Cross Site Request Forgery (CSRF) Vulnerability
- From: YGN Ethical Hacker Group <lists@xxxxxxxx>
- Date: Tue, 1 Jan 2013 11:27:21 +0800
- List-help: <mailto:firstname.lastname@example.org>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:email@example.com>
- List-subscribe: <mailto:firstname.lastname@example.org>
- List-unsubscribe: <mailto:email@example.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
CubeCart 5.x versions are vulnerable to Cross Site Request Forgery (CSRF).
CubeCart is an "out of the box" ecommerce shopping cart software
solution which has been written to run on servers that have PHP &
MySQL support. With CubeCart you can quickly setup a powerful online
store which can be used to sell digital or tangible products to new
and existing customers all over the world.
3. VULNERABILITY DESCRIPTION
CubeCart 5.x versions contain a flaw that allows a remote Cross-site
Request Forgery (CSRF / XSRF) attack. The flaw exists because the
application does not require multiple steps or explicit confirmation
for sensitive transactions for majority of administrator functions
such as adding new user, assigning user to administrative privilege.
By using a crafted URL, an attacker may trick the victim into visiting
to his web page to take advantage of the trust relationship between
the authenticated victim and the application. Such an attack could
trick the victim into executing arbitrary commands in the context of
their session with the application, without further prompting or
4. VERSIONS AFFECTED
file in Site Documents)
(Delete file in File Manager)
(Delete customer user)
The vendor has chosen not to fix the issue.
Workaround is not to visit malicious sites during log-in.
CubeCart Development Team
Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.
9. DISCLOSURE TIME-LINE
2012-12-22: Vulnerability disclosed
2012-12-24: The vendor replied that the fix would not be implemented.
2013-01-01: Vulnerability disclosed
Original Advisory URL:
CubeCart Home Page: http://cubecart.com/
YGN Ethical Hacker Group
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd