Title: Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities
Advisory ID: ZSL-2012-5115
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 30.11.2012

Summary

Powerful open source ecommerce platform.

Description

Axis Commerce suffers from multiple stored XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Vendor

Axis - http://www.axiscommerce.com

Affected Version

0.8.7.2

Tested On

Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a

Vendor Status

[27.11.2012] Vulnerabilities discovered.
[28.11.2012] Initial contact with the vendor.
[29.11.2012] No reply from vendor.
[30.11.2012] Public security advisory released.

PoC

axiscommerce_xss.html

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://github.com/axis/axiscommerce/issues/233
[2] http://packetstormsecurity.org/files/118501
[3] http://cxsecurity.com/issue/WLB-2012120008
[4] http://1337day.com/exploit/19840
[5] http://secunia.com/advisories/51477
[6] http://xforce.iss.net/xforce/xfdb/80457
[7] http://www.securityfocus.com/bid/56781
[8] http://www.osvdb.org/show/osvdb/88114
[9] http://www.osvdb.org/show/osvdb/88115

Changelog

[30.11.2012] - Initial release
[01.12.2012] - Added reference [2], [3] and [4]
[03.12.2012] - Added reference [5]
[04.12.2012] - Added reference [6] and [7]
[07.12.2012] - Added reference [8] and [9]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk