OpenCart 18.104.22.168: CSRFDate: 2015-10-07 15:55:51
|Affected Product:||OpenCart 22.214.171.124|
|Fixed in:||not fixed|
|Fixed Version Link:||n/a|
|Reported to vendor:||09/01/2015|
|Disclosed to public:||10/07/2015|
|Release mode:||Full Disclosure|
|Credits||Tim Coen of curesec GmbH|
2. Vulnerability Description
While CSRF protection exists for the actions of an admin, it does not exist for customers. This means that customer accounts can be compromised by an attacker if the victim visits an attacker controlled website while logged in.
This issue was already discovered in 2013 by Saadat Ullah, but new versions of OpenCart are still vulnerable as no fix has been released.
3. Proof of Concept
Change profile information, including email address, which is used when logging in:
This issue was not fixed by the vendor.
5. Report Timeline
|09/01/2015||Informed Vendor about Issue (no reply)|
|09/22/2015||Reminded Vendor of disclosure date|
|09/23/2015||Vendor points out that issue is already known, and that they do not plan on releasing a fix|
|10/07/2015||Disclosed to public|