Security Advisory - Curesec Research Team 1. Introduction Affected Product: OpenCart 2.0.3.1 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://ift.tt/1DbzMBn Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 09/01/2015 Disclosed to public: 10/07/2015 Release mode: Full Disclosure CVE: n/a Credits Tim Coen of Curesec GmbH 2. Vulnerability Description While CSRF protection exists for the actions of an admin, it does not exist for customers. This means that customer accounts can be compromised by an attacker if the victim visits an attacker controlled website while logged in. This issue was already discovered in 2013 by Saadat Ullah, but new versions of OpenCart are still vulnerable as no fix has been released. 3. Proof of Concept Change Password:
Change profile information, including email address, which is used when logging in:
4. Solution This issue was not fixed by the vendor. 5. Report Timeline 09/01/ Informed Vendor about Issue (no reply) 2015 09/22/ Reminded Vendor of disclosure date 2015 09/23/ Vendor points out that issue is already known, and that they do not 2015 plan on releasing a fix 10/07/ Disclosed to public 2015 Blog Reference: http://ift.tt/1WFMw6Z
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment