MobileCartly 1.0 <= Remote Code Execution Vulnerability

[pereira () secbiz de]

#################################################
MobileCartly 1.0 <= Remote Code Execution
#################################################

Discovered by: Jean Pascal Pereira <pereira () secbiz de>

Vendor information:

"MobileCartly is an Open Source Mobile Shopping Cart Software."

Vendor URI: http://www.mobilecartly.com

#################################################

Risk-level: High

The application is prone to a remote code execution vulnerability.

-------------------------------------

shoppingcart/add.php, line 9:

if( isset( $_COOKIE['MCCHECKOUT'] ) ) {
$checkout = unserialize($_COOKIE['MCCHECKOUT']);
$checkout[] = $product;

setcookie('MCCHECKOUT', serialize($checkout), time()+10800);

-------------------------------------

Solution:

Perform some input validation to get control over the serialized data.
As end-user you should at least keep your PHP version up to date.

-------------------------------------

#################################################