July 2019 Summaries

The OXID eShop software, used by industry leaders such as Mercedes, BitBurger, and Edeka, is vulnerable to Remote Code Execution due to a combination of two critical vulnerabilities. An unauthenticated attacker can exploit these weaknesses to gain control over the shop's administration panel and server, potentially leading to full access. The first vulnerability involves SQL Injection in the product details section, allowing an attacker to pivot into the backend and inject malicious code. Additionally, a PHP Object Injection vulnerability in the import section enables remote code execution. These vulnerabilities highlight the importance of continuous security testing to minimize risk factors in sensitive source code, and the OXID eShop vendor has since released a fix for these issues. It is highly recommended that all OXID eShops be updated to the latest version to prevent potential exploitation.

The TYPO3 CMS has been identified with two critical vulnerabilities, CVE-2019-12747 and CVE-2019-12748, which allow for arbitrary PHP code execution on the underlying system as authenticated users, particularly those in the backend section. The first vulnerability occurs when saving any form in the backend section, allowing a malicious user to override database values containing serialized data, leading to a PHP Object Injection that enables remote code execution. The second vulnerability is a Stored Cross-Site Scripting vulnerability in the Site Redirects module, which can be exploited by an unprivileged user with access to this feature. Both vulnerabilities have been reported and addressed in TYPO3 version 9.5.8, highlighting the importance of keeping software up-to-date to prevent exploitation.

A successful attack on a Magento store enables an unauthenticated adversary to persistently inject a JavaScript payload into the administrator backend, allowing for automated exploit steps in the browser of a victim. This vulnerability can be chained with another authentication bypass, resulting in a full takeover of the store by the attacker. The vulnerabilities are linked to the Authorize.Net payment module and affect many Magento stores that use this module. The severity of these issues is rated as high due to the ease of exploitation without prior knowledge or access to the store. An unauthenticated Stored XSS vulnerability can be chained with an authenticated Phar Deserialization vulnerability, enabling mass exploitation on a large scale. The exploitation often depends on multiple sanitization and logic flaws in Magento. It is highly recommended that all users update to the latest Magento version to fix these vulnerabilities.