PT-2017-7554 · Alegrocart · Alegrocart

Tim Coen · Published 2017-09-11 · Updated 2017-09-18 · CVE-2015-9226

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlegroCart version 1.2.8

Description The issue allows remote administrators to execute arbitrary SQL commands via the download parameter in the check download and possibly check filename function in upload/admin2/model/products/model admin download.php. Additionally, remote authenticated users with a valid Paypal transaction token can execute arbitrary SQL commands via the ref parameter in the orderUpdate function in upload/catalog/extension/payment/paypal.php.

Recommendations For AlegroCart version 1.2.8, as a temporary workaround, consider restricting access to the check download and check filename functions in upload/admin2/model/products/model admin download.php and the orderUpdate function in upload/catalog/extension/payment/paypal.php to minimize the risk of exploitation. Avoid using the download and ref parameters in the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-9226

Affected Products

Alegrocart

References · 5

• 🔥 http://packetstormsecurity.com/files/134362/AlegroCart-1.2.8-SQL-Injection.html · Exploit
• 🔥 https://blog.curesec.com/article/blog/AlegroCart-128-SQL-Injection-104.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Nov/68 · Exploit
• 🔥 https://exploit-db.com/exploits/38727 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9226 · Security Note