PT-2017-7554 · Alegrocart · Alegrocart

Tim Coen · Publicado 2017-09-11 · Atualizado 2017-09-18 · CVE-2015-9226

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlegroCart version 1.2.8

Description The issue allows remote administrators to execute arbitrary SQL commands via the download parameter in the check download and possibly check filename function in upload/admin2/model/products/model admin download.php. Additionally, remote authenticated users with a valid Paypal transaction token can execute arbitrary SQL commands via the ref parameter in the orderUpdate function in upload/catalog/extension/payment/paypal.php.

Recommendations For AlegroCart version 1.2.8, as a temporary workaround, consider restricting access to the check download and check filename functions in upload/admin2/model/products/model admin download.php and the orderUpdate function in upload/catalog/extension/payment/paypal.php to minimize the risk of exploitation. Avoid using the download and ref parameters in the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-9226

Produtos afetados

Alegrocart

Referências · 5

• 🔥 http://packetstormsecurity.com/files/134362/AlegroCart-1.2.8-SQL-Injection.html · Exploit
• 🔥 https://blog.curesec.com/article/blog/AlegroCart-128-SQL-Injection-104.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Nov/68 · Exploit
• 🔥 https://exploit-db.com/exploits/38727 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9226 · Nota de Segurança