Not sure if you guys saw this one yet already, just wanted to give you a heads up.

Armorize Technologies Security Advisory

Advisory No:
Armorize-ADV-2006-0003

Date:
2006/9/27

Summary:
Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a foundation of OScommerce GPL code. It provides an easy-to-setup and run online store.

Affected Software:
Zen Cart 1.3.5

Vulnerability Description:
Cross-Site Scripting

Analysis/Impact:
Privacy leakages from the client-side may lead to session hijacking, identity theft and information theft.

Detection/Exploit(partial):
http://www.example.com/[PATH]/login.php
http://www.example.com/[PATH]/password_forgotten.php

Protection/Solution:

1. Escape every questionable URI and HTML script.
2. Remove prohibited user input.

Credit: Security Team at Armorize Technologies, Inc. ([email protected])

Additional Information:
Link to this Armorize advisory
http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0002

Links to all Armorize advisories
http://www.armorize.com/advisory/

Links to Armorize vulnerability database
http://www.armorize.com/resources/vulnerability.php

advertising removed

I have been unable to reproduce any XSS exploit on the 2 pages mentioined.

I have also emailed the website responsible for the report, asking for more details of their advisory

If anyone in the community can reproduce an XSS exploit on these 2 pages (and of course on any other ZC page :) ) I would love to hear from you,

Thanks BTW for the report, Although as a team we do subscribe to a number o f security alert email lists, its not possible to cover them all. We appreciate community members helping out wherever they can.

Sure no problem, I got this one from [email protected] mailing list.

The original report was a little confusing as it seemed to suggest that the problem was with login/password forgotten code on the catalog side of Zen Cart.

I would like to thank Armorize Technologies for responding very swiftly to my emails.

The problem it seems lies in the admin code, not catalog and the 2 files they mention are

/admin/login.php
/admin/password_forgotten.php

taking each in turn:

**admin/login.php line 57 **

<input style="float: left" type="text" id="admin_name" name="admin_name" value="<?php echo $_POST['admin_name']; ?>" />
```should be changed to ```
<input style="float: left" type="text" id="admin_name" name="admin_name" value="<?php echo zen_output_string($admin_name); ?>" />

and on line 60

<input style="float: left" type="password" id="admin_pass" name="admin_pass" value="<?php echo $_POST['admin_pass']; ?>" />
```should be changed to```
<input style="float: left" type="password" id="admin_pass" name="admin_pass" value="<?php echo zen_output_string($admin_pass); ?>" />

and admin/password_forgotten.php line 84

<label for="admin_email"><?php echo TEXT_ADMIN_EMAIL; ?><input type="text" id="admin_email" name="admin_email" value="<?php echo $_POST['admin_email']; ?>" /></label>
```changed to ```
<label for="admin_email"><?php echo TEXT_ADMIN_EMAIL; ?><input type="text" id="admin_email" name="admin_email" value="<?php echo zen_output_string($admin_email); ?>" /></label>

We are currently preparing a patch for 1.3.5 to address this issue,

is ready before I do a fresh install for my site?

Right now I only take cash payments.

Henry

**Zen Cart v1.3.5 XSS PATCH Released Oct 1, 2006

To combat a reported XSS exploit vulnerability in Zen Cart, simply copy the
enclosed /admin files for login.php and password_forgotten.php to your
admin folder.

Remember, if you have renamed your admin folder, you will have to use that
folder name when copying/uploading.**

File can be downloaded here:
http://sourceforge.net/project/showfiles.php?group_id=83781&package_id=171544&release_id=444622

These fixes are NOT included in the main "full-fileset" zip.
Please apply these fixes AFTER unzipping the main full-fileset zip contents.

Is it only 1.3.5 vulnerable ?

The strings are the same in 1.3.2. So I would say it was vulnerable.
I just edited the two files, uploaded them and logged back in.
User input is always a problem. We need this option.:lamo:

And I have just looked at a v. 1.3.0.2

It is also affected. I would probably bet that the problem exists in all the versions.

Good job, Gents and Ladies. Thanks for being on top of these changes.

Is there any mail list we can subscribe to for these updates? Checking the forum on a regular basis seems to be somewhat hit & miss.

yes, the updates forum.

Ah.... You mean the big blue link that says "Click here to subscribe to these announcements."?

Thanks! :smartass:

If we are running 2.6, should we apply these fixes?

Okay ... Yes ... I'll go on record as saying ... yes ... everyone should apply these fixes.

The line numbers may be different, and the content slightly different too. But the concept of the fix is the same.

sadie:

If we are running 2.6, should we apply these fixes?
As for people running v1.2.6, you really should at least upgrade to v1.2.7 due to important security bugfixes applied to 1.2.7. That's in addition to this suggested fix, which is very minor in comparison to the fixes for 1.2.7

IHaveADotCom:

Ah.... You mean the big blue link that says "Click here to subscribe to these announcements."?

wait.. what? where is that??:lookaround:

Look for the Patch in SourceForge.

These fixes are all built-in to v1.3.6

Dr Byte,

Does it mean that my recently installed 1.3.5 and patched as suggested earlier is basically up-to-date exceot for the new stylesheets?

Thanks.

henry

henrygoh:

Dr Byte,

Does it mean that my recently installed 1.3.5 and patched as suggested earlier is basically up-to-date exceot for the new stylesheets?

Thanks.

henry

No. There were a LOT of fixes and feature improvements build in 1.3.6, especially address-form related fixes.
But, as far as XSS security issues, yes, you are up-to-date on known security issues if you've applied both posted patches for 1.3.5.
You still should be upgrading to 1.3.6 for the address-form benefits though.