Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 3 May 2016 18:40:24 +0200
From: LSE-Advisories <>
Subject: LSE Leading Security Experts GmbH - LSE-2016-02-03 - OXID eShop Path
 Traversal Vulnerability

=== LSE Leading Security Experts GmbH - Security Advisory 2016-02-03 ===

OXID eShop Path Traversal Vulnerability

Affected Versions
Community Edition 4.9.7

Issue Overview
Vulnerability Type: path traversal, privilege escalation
Version: Tested in Community Edition 4.9.7
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: OXID eSales AG
Vendor URL:
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory URL:
Advisory Status: Public
CVE-Number: NA
CVSS 2.0: 3.5  (AV:N/AC:M/Au:S/C:P/I:N/A:N)

A missing file path validation allows an authenticated user with permission
to add or edit products to read any file on the file system without permissions.

Issue Description
While conducting an internal evaluation of the software, LSE Leading
Security Experts GmbH discovered a path traversal vulnerability in the product
downloads function. A user with permissions to change or add products may change
the Downloads name to a local file (e.g. "../../../"). This may lead
to a privilege escalation.

Temporary Workaround and Fix
Install latest update 4.9.8/5.2.8

Proof of Concept
Create a new product in the backend. In the "Downloads" tab set "name of the uploaded
file" to "../../../". Go to the frontend and buy the related product.
Move to "My account" and choose the download section. Download the file and enjoy
full database credentials.

2016-02-05 Issue discovered
2016-02-22 Vendor contacted
2016-02-24 Vendor confirmed
2016-05-03 Vendor released patch
2016-05-03 Advisory release

GPG Signature
This advisory is signed with the GPG key of the
LSE Leading Security Experts GmbH advisories team.
The key can be downloaded here:

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.