0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
CubeCart 5.2.0 PHP Object Injection Vulnerability
[-------------------------------------------------------------------------
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection
Vulnerability
-------------------------------------------------------------------------
[-] Software Link:
http://www.cubecart.com/
[-] Affected Versions:
All versions from 5.0.0 to 5.2.0
[-] Vulnerability Description:
The vulnerable code is located in the Cubecart::_basket() method
defined in the /classes/cubecart.class.php script:
519. // Update shipping values
520. if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
521. $GLOBALS['cart']->set('shipping',
unserialize(base64url_decode($_POST['shipping'])));
522. if (!isset($_POST['proceed'])) {
523. httpredir(currentPage());
524. }
525. }
User input passed through the $_POST['shipping'] parameter is not
properly sanitized before being
used in an unserialize() call at line 521. This can be exploited to
inject an arbitrary object into
the application scope. For e.g. the destructor method of the "Config"
class could be abused:
78. public function __destruct() {
79. //Do we need to write to the db
80. if ($this->_write_db) {
81. $this->_writeDB();
82. }
83. }
By sending a specially crafted serialized "Config" object, an attacker
might be able to change the
application configuration settings with arbitrary values, and this can
lead to make the application
vulnerable to malicious attacks such as Cross-Site Scripting, SQL
Injection or Denial of Service.
[-] Solution:
Upgrade to version 5.2.1 or higher.
[-] Disclosure Timeline:
[27/01/2013] - Issue reported to
http://bugs.cubecart.com/view.php?id=511
[31/01/2013] - Version 5.2.1 released:
http://forums.cubecart.com/?showtopic=47026
[31/01/2013] - CVE number requested
[04/02/2013] - CVE number assigned
[06/02/2013] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1465 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
http://karmainsecurity.com/KIS-2013-02
# 0day.today [2024-12-24] #