CVE-2012-2629

Vulnerability

Axous 1.1.1 and earlier contain multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities. The CSRF issue exists in admin/administrators_add.php via an addnew action, allowing an attacker to add a new administrator account without proper token validation. Persistent XSS vulnerabilities are present in several admin parameters: page_title in admin/content_pages_edit.php; category_name[] in admin/products_category.php; site_name, seo_title, meta_keywords in admin/settings_siteinfo.php; numerous company settings fields in admin/settings_company.php; and email settings fields in admin/settings_email.php. These parameters are not sanitized before being stored and displayed, leading to stored XSS [1].

Exploitation

For CSRF exploitation, an attacker must trick an authenticated administrator into visiting a crafted HTML page or clicking a malicious link while logged into the Axous admin panel. The attacker can then submit a request to admin/administrators_add.php to create a new admin account with arbitrary credentials. For XSS, an attacker with any level of access (e.g., a low-privileged user or via CSRF) can inject JavaScript payloads into the vulnerable parameters. When an administrator views the affected pages (e.g., editing a content page, managing categories, or viewing site settings), the injected script executes in the context of the admin's session [1].

Impact

Successful CSRF allows an attacker to create a new administrator account, gaining full control over the Axous application. Successful XSS enables the attacker to execute arbitrary JavaScript in the administrator's browser, potentially stealing session cookies, performing actions on behalf of the admin, or defacing the site. Combined, these vulnerabilities can lead to complete compromise of the Axous installation [1].

Mitigation

No official patch or fixed version has been released by the vendor for Axous 1.1.1 or earlier. As of the publication date (2020-02-20), the software appears to be abandoned or unsupported. Mitigation strategies include restricting access to the admin panel via IP whitelisting, using a web application firewall (WAF) to block malicious requests, and implementing additional CSRF tokens and input sanitization manually. Users should consider migrating to an alternative, actively maintained e-commerce platform [1].