The eCommerce platform OXID has recently addressed some serious security flaws. These OXID eShop vulnerabilities could allow an attacker for remote takeover upon an exploit.
OXID eShop Vulnerabilities
Reportedly, researchers from RIPS have spotted multiple security flaws in the OXID eCommerce platform. As revealed, the flaws could allow remote website hacking upon exploiting by a potential attacker.
Elaborating on their findings regarding the OXID eShop vulnerabilities in their blog post, the researchers stated that they discovered two different vulnerabilities in the platform.
The researchers identified one of these vulnerabilities as a SQL injection flaw. An unauthenticated attacker could simply exploit the flaw with a specially crafted URL. This could allow the attacker to create a new admin account gaining full control of the website.
The researchers have demonstrated the exploit for this vulnerability in the following video.
In addition team RIPS also spotted another vulnerability in the admin panel of the platform. specifically, they found a PHP objection vulnerability in the import section that could induce RCE attacks. They have also shared a video as the PoC for the exploit.
OXID Patched The Flaws
Upon receiving the report regarding the flaw from researchers, OXID worked out to create a fix. They have acknowledged the vulnerability having CVE identifier CVE-2019-13026 in their security bulletin. According to the vulnerability description,
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.
The vendors have rolled-out the fix with version OXID eShop v6.0.5 and v6.1.4 (Enterprise Edition, Community Edition, and Professional Edition).
The vendors confirmed there were no reports of exploits of the SQL injection flaw in the wild. However, they haven’t spoken on the other vulnerability in the patched version.
Users of OXID eShop must ensure upgrading to the patched version to remain secure.
Let us know your thoughts in the comments.