XT-Commerce 1.0 Beta 1 Backup Vulnerability Explained

What this paper is

This paper details a vulnerability in XT-Commerce version 1.0 Beta 1 that allows an attacker to create and download a backup of the application's database. The vulnerability lies in the backup.php script within the admin directory. By manipulating URL parameters, an attacker can trigger the backup process and then download the resulting backup file.

Simple technical breakdown

The XT-Commerce application has an administrative backup feature. This feature, when accessed in a specific way through a web browser, doesn't properly validate requests. An attacker can send a crafted URL to the backup.php script. This URL tells the script to create a database backup. Once the backup is created, another crafted URL can be used to directly download the backup file.

Complete code and payload walkthrough

The provided exploit is not a script with complex code or shellcode. Instead, it consists of specific URL patterns that exploit the application's functionality.

Backup Creation URL:
http://127.0.0.1/XT-Commerce/admin/backup.php/login.php?action=backupnow
- Explanation: This URL targets the backup.php script, which seems to be aliased or proxied through login.php in this context. The action=backupnow parameter instructs the script to initiate the database backup process. The script, when receiving this parameter, likely executes its internal backup logic, creating a file (e.g., db_comm-YYYYMMDDHHMMSS.sql) in a predictable location on the server.
Backup Download URL:
http://127.0.0.1/XT-Commerce/admin/backup.php/login.php?action=download&file=db_comm-20100301222138.sql
- Explanation: This URL also targets backup.php via login.php.
  - action=download: This parameter tells the script to perform a download operation.
  - file=db_comm-20100301222138.sql: This parameter specifies the name of the backup file to be downloaded. The example filename db_comm-20100301222138.sql indicates a database backup created on March 1, 2010, at 22:21:38. An attacker would need to know or guess the correct filename of the backup they wish to download.

Mapping:

http://<target>/XT-Commerce/admin/backup.php/login.php?action=backupnow -> Triggers the creation of a database backup file.
http://<target>/XT-Commerce/admin/backup.php/login.php?action=download&file=<backup_filename.sql> -> Downloads the specified backup file.

There is no traditional code or shellcode in this exploit. The "payload" is effectively the crafted URLs that manipulate the application's intended functionality.

Practical details for offensive operations teams

Required Access Level: Unauthenticated access to the web application. The vulnerability is exposed through publicly accessible URLs.
Lab Preconditions:
- A running instance of XT-Commerce v1.0 Beta 1.
- The application must be accessible via HTTP/HTTPS.
- The admin/backup.php script must be present and functional (or at least reachable).
- A database must be configured and in use by the application for a backup to be generated.
Tooling Assumptions:
- A web browser (the paper notes issues with IE and suggests Opera or Firefox).
- A web proxy (like Burp Suite or OWASP ZAP) to intercept and modify requests, although for this specific exploit, direct browser manipulation is sufficient.
- A tool to list directory contents or guess filenames if the exact backup name is unknown (though the paper implies the name is predictable).
Execution Pitfalls:
- Filename Guessing: The primary challenge is knowing the exact filename of the backup. The format db_comm-YYYYMMDDHHMMSS.sql is a strong hint, but the exact timestamp might vary. If the attacker cannot guess the filename, they cannot download the backup.
- Server Configuration: The backup.php script might be disabled or have different access controls in other configurations.
- Browser Compatibility: As noted, some browsers might not handle the download correctly, requiring experimentation.
- File Path Traversal (Potential): While not explicitly demonstrated, if the file parameter is not properly sanitized, there's a potential for directory traversal to download other sensitive files, though this is speculative based on the provided exploit.
- Web Server Configuration: The web server itself might prevent direct access to .sql files or have security measures that block these types of requests.
Telemetry:
- Web Server Logs: Look for requests to /XT-Commerce/admin/backup.php/login.php with action=backupnow and action=download.
- File System Activity: Monitor for the creation of .sql files in the application's backup directory.
- Network Traffic: Observe outbound traffic from the server if the backup file is being served directly.

Where this was used and when

Context: This vulnerability was discovered and published in 2010. It targets a specific e-commerce platform, XT-Commerce, likely in its early beta phase.
Usage: Exploits of this nature are typically used by penetration testers during authorized engagements to demonstrate data exfiltration risks. It's also possible it was used by malicious actors against unpatched or vulnerable XT-Commerce installations.
Timeframe: The exploit was published on April 29, 2010. The vulnerability would have existed in XT-Commerce v1.0 Beta 1 prior to this date.

Defensive lessons for modern teams

Input Validation is Crucial: Never trust user-supplied input, especially in URL parameters. All parameters, like action and file, should be strictly validated against expected values and formats.
Secure File Handling: When serving files, ensure that:
- The file path is absolute and points only to the intended directory.
- Directory traversal attempts are prevented.
- Direct access to sensitive file types (like database dumps) is restricted.
Least Privilege: Administrative functions should require proper authentication and authorization. Unauthenticated access to backup functionalities is a severe misconfiguration.
Regular Patching and Updates: Ensure all web applications and their components are kept up-to-date with the latest security patches.
Web Application Firewalls (WAFs): WAFs can help detect and block requests containing suspicious URL patterns, although they are not a foolproof solution.
Secure Backup Procedures: Backups should be stored securely, encrypted, and not directly accessible via web URLs.

ASCII visual (if applicable)

This exploit is primarily a URL manipulation technique, so a complex architecture diagram isn't strictly necessary. However, a simplified flow can be visualized:

+-----------------+      +---------------------+      +--------------------+
| Attacker's      |----->| Web Browser         |----->| XT-Commerce Server |
| Machine         |      | (Crafted URL)       |      | (backup.php)       |
+-----------------+      +---------------------+      +--------------------+
                                                             |
                                                             | 1. action=backupnow
                                                             v
                                                     +--------------------+
                                                     | Database Backup    |
                                                     | Process Initiated  |
                                                     +--------------------+
                                                             |
                                                             | 2. Backup File Created
                                                             v
+-----------------+      +---------------------+      +--------------------+
| Attacker's      |----->| Web Browser         |----->| XT-Commerce Server |
| Machine         |      | (Crafted URL)       |      | (backup.php)       |
+-----------------+      +---------------------+      +--------------------+
                                                             |
                                                             | 3. action=download
                                                             |    & file=<backup_name>
                                                             v
                                                     +--------------------+
                                                     | Backup File Served |
                                                     | to Attacker        |
                                                     +--------------------+

Source references

Paper Title: XT-Commerce v1 Beta 1 => by Pass / Creat and Download Backup Vulnerability
Author: indoushka
Published: 2010-04-29
Exploit-DB Paper ID: 12447
Exploit-DB URL: https://www.exploit-db.com/papers/12447

Original Exploit-DB Content (Verbatim)

========================================================================================                  
| # Title    : XT-Commerce v1 Beta 1 => by Pass / Creat and Download Backup Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                                                                                                                                    
| # Dork     : Powered by XT-Commerce                                                                                                               
| # Tested on: windows SP2 Français V.(Pnx2 2.0)        
| # Bug      : Backup                                                                     
======================      Exploit By indoushka       =================================
# Exploit  :  

http://127.0.0.1/XT-Commerce/admin/backup.php/login.php?action=backupnow

to download buckup :http://127.0.0.1/XT-Commerce/admin/backup.php/login.php?action=download&file=db_comm-20100301222138.sql

db_comm-20100301222138.sql chang it to the name of the backup and you cant download it with IE i download it with opera 10.10 + Mozilla Firefox



Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * www.no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net * D4NB4R http://www.ilegalintrusion.net/foro/
--------------------------------------------------------------------------------------------------------------

By exploitdb papers bot•April 29, 2010•

papers