AOH :: HP Unsorted O :: BX6018.HTM

OXID eShop Enterprise: Session Fixation and XSS Vulnerabilities



OXID eShop Enterprise: Session Fixation and XSS Vulnerabilities
OXID eShop Enterprise: Session Fixation and XSS Vulnerabilities



---------------------------------------------

 OXID eShop Enterprise Edition
 - Session Fixation Vulnerability
 - Stored Cross Site Scripting Vulnerability
 Date: 30.03.2010

---------------------------------------------

- Description

OXID eShop EE is a widespread and popular CMS for online shops.
The current release (4.2.0) has been found vulnerable to a session fixation and a XSS attack.

- Session Fixation

Passing the parameter sid via URL allows an attacker fixate the session ID to a given value.
By fooling legitimate users to follow the attacker provided URL with the fixated session ID, the attacker would be able to overtake the users session.

Example: http://vulnerable.system.com/index.php?sid=12345 

- XSS
A stored XSS vulnerability exists in the recommendation list (account_recommlist.php) in the fields recomm_title, recomm_author and recomm_desc. No further example will be given.

- Solution

Update to version 4.3.0

- Credits

The vulnerabilities were discovered by Michael Mueller from Integralis
michael#dot#mueller#at#integralis#dot#com

- Timeline

23.03.2010 - Vulnerabilities discovered
23.03.2010 - Vendor contacted
23.03.2010 - Initial vendor response
25.03.2010 - Vendor response with ACK and fix date
30.03.2010 - Public disclosure

- Reference

Vendor Security Information
http://wiki.oxidforge.org/Category:Security_bulletins 

Vendor Homepage
http://www.oxid-esales.com/ 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.