Jump to content



Member Since 03 Mar 2009
Offline Last Active Feb 21 2015 10:46 AM

Topics I've Started

Re: Critical Security Vulnerability In Cs-Cart And Multi-Vendor 2.x.x To 4.1.2

27 May 2014 - 02:54 AM

Good job on catching this exploit so quickly.

We got the email and indeed located the files.

The atos & hsbc php files and associated directories have been deleted as per the instructions leaving only questions, the answers to which may may be of interest to the community should they be answered.

1. What was the attack vector?
My working assumption is of course the atos and hsbc payment files we were instructed to delete. If this is correct, what was the behavior of those files that allowed infection?

2. How can we mitigate a repeat of the same exploit?
This may well be answered by a clear explanation of the first question, however, it is still a question worth asking pending a detailed description of the methodology used to exploit the attack vector.

3. To quote the email:
The update fixes a vulnerability that can result in a remote unauthenticated attacker executing arbitrary script in the context of the end-user's browser session.

What update is this referring to? I understand it to mean the fix of deleting the files. Is that correct?

Thanks to who ever has the time to answer,