Cross Site Request Forgery - v1.3.8

My first bug report.

I have tested on two installations of ZenCart with all patches and still working.

Cross-site Request Forgery (Wikipedia):

Cross-site Request Forgery (CSRF) is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

Affected URL: http://www.yourstore.com (Home)

<form name="currencies_form" action="http://www.yourstore.com/index.php?main_page=index" method="get"> ... </form>


Affected URL: http://www.yourstore.com/index.php?main_page=products_new

<form name="sorter_form" action="http://www.yourstore.com/index.php?main_page=products_new" method="get"> ... </form>


Affected URL: http://www.yourstore.com/index.php?main_page=products_new

<form name="multiple_products_cart_quantity" action="http://www.yourStore.com/index.php?main_page=products_new&disp_order=6&action=multiple_products_add_product" method="post" enctype="multipart/form-data"> ... </form>


Affected URL: http://www.YourStore.com/index.php?main_page=featured_products

<form name="sorter_form" action="http://www.YourStore.com/index.php?main_page=featured_products" method="get"> ... </form>


Affected URL: http://www.YourStore.com/index.php?main_page=featured_products

<form name="multiple_products_cart_quantity" action="http://www.yourstore.com/index.php?main_page=featured_products&disp_order=1&action=multiple_products_add_product" method="post" enctype="multipart/form-data"> ... </form>


Affected URL: http://www.yourstore.com/index.php?main_page=products_all

<form name="sorter_form" action="http://www.YourStore.com/index.php?main_page=products_all" method="get"> ... </form>


Affected URL: http://www.YourStore.com/index.php?main_page=products_all

<form name="multiple_products_cart_quantity" action="http://www.YourStore.com/index.php?main_page=products_all&disp_order=1&action=multiple_products_add_product" method="post" enctype="multipart/form-data"> ... </form>


Affected url: http://www.yourstore.com/index.php?main_page=contact_us

<form name="contact_us" action="http://www.yourstore.com/index.php?main_page=contact_us&action=send" method="post"> ... </form>


Affected URL: http://www.yourstore.com/index.php?main_page=discount_coupon

<form action="http://www.yourstore.com/index.php?main_page=discount_coupon&action=lookup" method="post"> ... </form>


Affected URL: http://www.yourstore.com/index.php?main_page=password_forgotten

<form name="password_forgotten" action="http://www.YourStore.com/index.php?main_page=password_forgotten&action=process" method="post"> ... </form>

I'm not a PHP-programmer and I cannot supply any temporal patch but the solution I have found for this one (by searching through Google ;p) is to protect the forms and urls with tokens for later being checked by the server.

Peace :cool:

You've listed several <form>s from your site, but you've not given any proof-of-concept. Where's the actual proof of ability to exploit a problem?

Okay, when I got back at home I'll try to post some PoC's :)

Okay, let's explain it:

When I found that the forms were vulnerable to CSRF, I wasn't looking at the background work.

My fault: If you try to use CSRF to make orders on some website, the attacker needs to know the tokens given by the session and they're randomly generated.

The process doesn't involve any parameters in the request / sent url's so there's no way to modify the values (Ex: Quantity or price) because they're set by the server (In this case CSRF doesn't affect the server fully).

So the post is useless, there's no need to test nothin' else..

The next bug report I'll try to exploit it first.

PS: Mods can close this thread.

There are some patches for known vulnerabilities in older versions of Zen Cart: http://www.zen-cart.com/forum/showthread.php?t=131115
We take security very seriously, and appreciate any reports of confirmed vulnerabilites.

(Note: Your post was moved to the private Security Concerns area instead of the public Bug Reports area in the interest of safety and security for live shops.)

If you do find a reproducable vulnerability not covered by a posted patch, please do share it with us via the Security Concerns section of the forum.

Thanks for the reply and I'll do if i found something else (Explotaible uh!).

s/found/find