OXID eShop Enterprise Edition
– Session Fixation Vulnerability
– Stored Cross Site Scripting Vulnerability
Date: 30.03.2010
– Description
OXID eShop EE is a widespread and popular CMS for online shops.
The current release (4.2.0) has been found vulnerable to a session fixation and a XSS attack.
– Session Fixation
Passing the parameter sid via URL allows an attacker fixate the session ID to a given value.
By fooling legitimate users to follow the attacker provided URL with the fixated session ID, the attacker would be able to overtake the users session.
Example: http://vulnerable.system.com/index.php?sid=12345
– XSS
A stored XSS vulnerability exists in the recommendation list (account_recommlist.php) in the fields recomm_title, recomm_author and recomm_desc. No further example will be given.
– Solution
Update to version 4.3.0
– Credits
The vulnerabilities were discovered by Michael Mueller from Integralis
michael#dot#mueller#at#integralis#dot#com
– Timeline
23.03.2010 – Vulnerabilities discovered
23.03.2010 – Vendor contacted
23.03.2010 – Initial vendor response
25.03.2010 – Vendor response with ACK and fix date
30.03.2010 – Public disclosure
– Reference
Vendor Security Information
http://wiki.oxidforge.org/Category:Security_bulletins
Vendor Homepage
http://www.oxid-esales.com/
Leave a Reply
You must be logged in to post a comment.