mailing list archives
TomatoCart 1.x | Vulnerable Piwik Extension
From: YGN Ethical Hacker Group <lists () yehg net>
Date: Sat, 5 Jan 2013 23:50:48 +0800
TomatoCart 1.x versions include outdated and vulnerable Piwik extension < 0.5.5.
TomatoCart is an innovative Open Source shopping cart solution
developed by Wuxi Elootec Technology Co., Ltd. It is forked from
osCommerce 3 as a separate project and is released under the GNU
General Public License V2. Equipped with the web2.0 Technology Ajax
and Rich Internet applications (RIAs), TomatoCart Team is devoted to
building a landmark eCommerce solution.
3. VULNERABILITY DESCRIPTION
TomatoCart 1.x versions include outdated and vulnerable Piwik
extension < 0.5.5 according to the the Piwik SVN checkout date
specified in /ext/piwik/index.php. This Piwik version has known
vulnerabilities such as Cross Site Scripting, Arbitrary URL Redirect
4. VERSIONS AFFECTED
Refer to REFERENCES section for the OSVDB site URL featuring known
The vendor did not show commitment in hardening the application.
It is recommended to use alternative shopping cart application with
good track record of security fixes.
Wuxi Elootec Technology Co., Ltd.
Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.
9. DISCLOSURE TIME-LINE
2012-04-22: Contacted the vendor through email
2012-04-29: Vendor replied and the vulnerability detail was sent
2013-01-05: Vulnerability not fixed
2013-01-05: Vulnerability disclosed
Original Advisory URL:
TomatoCart Home Page: http://www.tomatocart.com/
Piwik Reported Vulnerabilities:
YGN Ethical Hacker Group
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- TomatoCart 1.x | Vulnerable Piwik Extension YGN Ethical Hacker Group (Jan 05)