Security Bloggers Network 
SBN

osClass 3.6.1: Remote Code Execution via Image File

by Robin Peraglie on December 18, 2016

In this blog post, we examine three vulnerabilities that we detected in the open source marketplace software osClass 3.6.1:

  1. Cross-Site Scripting 
  2. File Write
  3. File Inclusion

By chaining these three vulnerabilities, the exploitation of the cross-site scripting issue leads to remote code execution on a targeted web server.

Cross-Site Scripting

The cross-site scripting vulnerability can be triggered by an authenticated administrator visiting a malicious link. Due to the generalized approach of input sanitization for HTML in osClass’s getParam() function, the parameter country_code is insufficiently secured for a JavaScript context in line 409.

oc-admin/themes/modern/settings/locations.php

408