Ravens PHP Scripts - Shop-Script FREE Security Bypass and PHP Code Execution

SECUNIA ADVISORY ID: SA26840

VERIFY ADVISORY: http://secunia.com/advisories/26840/

CRITICAL: Highly critical

IMPACT: Security Bypass, System access

WHERE: >From remote

SOFTWARE:
Shop-Script FREE 1.x - http://secunia.com/product/15759/
Shop-Script FREE 2.x - http://secunia.com/product/15760/

DESCRIPTION: Raz0r has discovered some vulnerabilities in Shop-Script FREE, which can be exploited by malicious people to bypass certain security restrictions and compromise a vulnerable system.

1) The admin.php script does not properly restrict access to logged in users and can be exploited with an HTTP client that does not follow redirects.

2) Input passed to the "colscount", "darkcolor", and "productscount" parameters in admin.php is not properly sanitised before it is written to the cfg/appearence.inc.php file which is included by the index.php script. This can be exploited to execute arbitrary PHP code.

Successful exploitation of this vulnerability requires valid administrator credentials (but see vulnerability #1). The vulnerabilities are confirmed in version 2.0 and reported in version 1.2. Other versions may also be affected.

SOLUTION: Restrict access to the "admin.php" script (e.g. with ".htaccess").

PROVIDED AND/OR DISCOVERED BY: Raz0r

ORIGINAL ADVISORY: http://milw0rm.com/exploits/4419