osCommerce Malformed Session ID XSS Vuln
Vendor : osCommerce
URL : http://www.oscommerce.com
Version : All Current Versions
Risk : Cross Site Scripting
Description:
osCommerce is an online shop e-commerce solution under on going
development by the open source community. Its feature packed
out-of-the-box installation allows store owners to setup, run, and
maintain their online stores with minimum effort and with absolutely
no costs or license fees involved.
Problem:
osCommerce is vulnerable to a XSS flaw. The flaw can be exploited when
a malicious user passes a malformed session ID to URI. Below is an
example of the flaw.
https://path/?osCsid=";><iframe src=http://www.gulftech.org></iframe>
This condition seems to affect only secure https connections, but was
convirmed by the developers to affect regular http connections in the
current CVS version of osCommerce.
Solution:
This is the response from the developer.
To fix the issue, the $_sid parameter needs to be wrapped around
tep_output_string() in the tep_href_link() function defined in
includes/functions/html_output.php.
Before:
if (isset($_sid)) {
$link .= $separator . $_sid;
}
After:
if (isset($_sid)) {
$link .= $separator . tep_output_string($_sid);
}
osCommerce 2.2 Milestone 3 will redirect the user to the index page when
a malformed session ID is used, so that a new session ID can be generated.
Credits:
Credits go to JeiAr of the GulfTech Security Research Team.
http://www.gulftech.org