Dec 15 2013

EBay Remote Code Execution Vulnerability Demonstrated

EBay Exploit
A German Security researcher has demonstrated a critical vulnerability on Ebay website.

He found a controller which was prone to remote-code-execution due to a type-cast issue in combination with complex curly syntax.

In a demo video, he exploited this RCE flaw on EBay website, and managed to display output of phpinfo() PHP function on the web page, just by modifying the URL and injecting code in that.

According to an explanation on his blog, he noticed a legitimate URL on EBay:

https://sea.ebay.com/search/?q=david&catidd=1

and modified the URL to pass any array values including a payload:

https://sea.ebay.com/search/?q[0]=david&q[1]=sec{${phpinfo()}}&catidd=1

Video Demonstration:

David has already reported the flaw responsibly to the Ebay Security Team and they have patched it early this week.

Source: eBay : Remote Code Execution