ViArt Shop Enterprise 4.1 (post-auth) Multiple Stored XSS Vulnerabilities
Title: ViArt Shop Enterprise 4.1 (post-auth) Multiple Stored XSS Vulnerabilities
Advisory ID: ZSL-2012-5108
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 25.09.2012
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
[24.09.2012] Contact with the vendor.
[24.09.2012] Vendor responds asking more details.
[24.09.2012] Sent detailed information to the vendor.
[25.09.2012] Vendor confirms the issues, releasing fix (http://www.viart.com/downloads/viart_shop-4.1.zip).
[25.09.2012] Coordinated public security advisory released.
Exploit coded by teppei - <iki@zeroscience.mk>
[2] http://packetstormsecurity.org/files/116875
[3] http://secunia.com/advisories/50716/
[4] http://xforce.iss.net/xforce/xfdb/78894
[5] http://1337day.com/exploits/19469
[6] http://www.osvdb.org/show/osvdb/85743
[7] http://www.osvdb.org/show/osvdb/85744
[8] http://www.osvdb.org/show/osvdb/85745
[9] http://www.osvdb.org/show/osvdb/85746
[26.09.2012] - Added reference [1], [2] and [3]
[27.09.2012] - Added reference [4] and [5]
[28.09.2012] - Added reference [6], [7], [8] and [9]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2012-5108
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 25.09.2012
Summary
Viart Shop is a PHP based e-commerce suite, aiming to provide everything you need to run a successful on-line business.Description
ViArt Shop suffers from multiple stored cross-site scripting vulnerabilities. The issues are triggered when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.Vendor
ViArt Software - http://www.viart.comAffected Version
4.1, 4.0.8 and 4.0.5Tested On
Microsoft Windows 7 Ultimate SP1 (EN)Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
Vendor Status
[09.09.2012] Vulnerabilities discovered.[24.09.2012] Contact with the vendor.
[24.09.2012] Vendor responds asking more details.
[24.09.2012] Sent detailed information to the vendor.
[25.09.2012] Vendor confirms the issues, releasing fix (http://www.viart.com/downloads/viart_shop-4.1.zip).
[25.09.2012] Coordinated public security advisory released.
PoC
viart_xss.htmlCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>Exploit coded by teppei - <iki@zeroscience.mk>
References
[1] http://cxsecurity.com/issue/WLB-2012090224[2] http://packetstormsecurity.org/files/116875
[3] http://secunia.com/advisories/50716/
[4] http://xforce.iss.net/xforce/xfdb/78894
[5] http://1337day.com/exploits/19469
[6] http://www.osvdb.org/show/osvdb/85743
[7] http://www.osvdb.org/show/osvdb/85744
[8] http://www.osvdb.org/show/osvdb/85745
[9] http://www.osvdb.org/show/osvdb/85746
Changelog
[25.09.2012] - Initial release[26.09.2012] - Added reference [1], [2] and [3]
[27.09.2012] - Added reference [4] and [5]
[28.09.2012] - Added reference [6], [7], [8] and [9]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
