← Advisories

Cart Engine 3.0.0 Remote Code Execution

High
Advisory ID
ZSL-2014-5182
Release Date
25 March 2014
Vendor
Affected Version
3.0.0
CVE
N/A
Tested On
Apache/2.4.7 (Win32), PHP/5.5.6, MySQL 5.6.14
Summary

Open your own online shop today with Cart Engine! The small, yet powerful and don't forget, FREE shopping cart based on PHP & MySQL. Unique features of Cart Engine include: CMS engine based on our qEngine, product options, custom fields, digital products, search engine friendly URL, user friendly administration control panel, easy to use custom fields, module expandable, sub products, unsurpassed flexibility...and more!

Description

Cart Engine suffers from an authenticated arbitrary code execution. The vulnerability is caused due to the improper verification of uploaded files in several modules thru several POST parameters. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script file that will be stored in '/public/image' directory.

Proof of Concept
Disclosure Timeline
07.03.2014Vulnerability discovered.
10.03.2014Vendor contacted.
11.03.2014Vendor responds asking more details.
11.03.2014Sent details to the vendor.
12.03.2014Working with the vendor.
13.03.2014Vendor working on a new version.
21.03.2014Asked vendor for status update.
21.03.2014Vendor promises patch release in April.
25.03.2014Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
25.03.2014Initial release
26.03.2014Added reference [3], [4] and [5]
27.03.2014Added reference [6], [7], [8], [9], [10] and [11]
14.04.2014Added reference [12]