Home page logo
/

bugtraq logo Bugtraq mailing list archives

MobileCartly 1.0 <= Remote Code Execution Vulnerability
From: pereira () secbiz de
Date: Wed, 8 Aug 2012 15:20:32 GMT

#################################################
MobileCartly 1.0 <= Remote Code Execution
#################################################

Discovered by: Jean Pascal Pereira <pereira () secbiz de>

Vendor information:

"MobileCartly is an Open Source Mobile Shopping Cart Software."

Vendor URI: http://www.mobilecartly.com

#################################################

Risk-level: High

The application is prone to a remote code execution vulnerability.

-------------------------------------

shoppingcart/add.php, line 9:

if( isset( $_COOKIE['MCCHECKOUT'] ) ) {
$checkout = unserialize($_COOKIE['MCCHECKOUT']);
$checkout[] = $product;

setcookie('MCCHECKOUT', serialize($checkout), time()+10800);

-------------------------------------

Solution:

Perform some input validation to get control over the serialized data.
As end-user you should at least keep your PHP version up to date.

-------------------------------------

################################################# 


  By Date           By Thread  

Current thread:
  • MobileCartly 1.0 <= Remote Code Execution Vulnerability pereira (Aug 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault