CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability

• Software Link:

http://www.cubecart.com

• Affected Versions:

All versions from 5.0.0 to 5.2.0.

• Vulnerability Description:

The vulnerable code is located in the Cubecart::_basket() method defined in the /classes/cubecart.class.php script:

519// Update shipping values
520if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
521    $GLOBALS['cart']->set('shipping', unserialize(base64url_decode($_POST['shipping'])));
522    if (!isset($_POST['proceed'])) {
523        httpredir(currentPage());
524    }
525}

User input passed through the $_POST[‘shipping’] parameter is not properly sanitized before being used in an unserialize() call at line 521. This can be exploited to inject an arbitrary object into the application scope. For e.g. the destructor method of the Config class could be abused:

78public function __destruct() {
79    //Do we need to write to the db
80    if ($this->_write_db) {
81        $this->_writeDB();
82    }
83}

By sending a specially crafted serialized Config object, an attacker might be able to change the application configuration settings with arbitrary values, and this can lead to make the application vulnerable to malicious attacks such as Cross-Site Scripting, SQL Injection or Denial of Service.

• Solution:

Upgrade to version 5.2.1 or higher.

• Disclosure Timeline:

[27/01/2013] – Issue reported to http://bugs.cubecart.com/view.php?id=511

[31/01/2013] – Version 5.2.1 released: http://forums.cubecart.com/?showtopic=47026

[31/01/2013] – CVE number requested

[04/02/2013] – CVE number assigned

[06/02/2013] – Public disclosure

• CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-1465 to this vulnerability.

• Credits:

Vulnerability discovered by Egidio Romano.