CVE-2018-5190
📋 TL;DR
CVE-2018-5190 is an authentication bypass vulnerability in PicturesPro Photo Cart that allows remote attackers to access arbitrary customer accounts by modifying cookie values. This affects Photo Cart 6 and 7 installations before the 2018 security patch. Attackers can impersonate legitimate users and potentially access sensitive customer data.
💻 Affected Systems
- PicturesPro Photo Cart
📦 What is this software?
Picturespro by Picturespro
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all customer accounts, unauthorized access to sensitive personal information, financial data exposure, and potential privilege escalation to administrative functions.
Likely Case
Unauthorized access to customer accounts, viewing of private photos and order history, potential modification of customer data, and session hijacking.
If Mitigated
Limited impact with proper network segmentation and monitoring, but still represents a serious authentication bypass that violates privacy expectations.
🎯 Exploit Status
Exploitation involves simple cookie manipulation without requiring authentication. The vulnerability is well-documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security-Patch-2018-B
Vendor Advisory: https://www.picturespro.com/support-forum/photo-cart/?t=38346-security-patch-for-photo-cart-2018
Restart Required: No
Instructions:
1. Download the Security-Patch-2018-B from PicturesPro support forum. 2. Apply the patch to affected Photo Cart installations. 3. Verify the patch was applied successfully by testing authentication mechanisms.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to detect and block cookie manipulation attempts targeting pc_head.php, pc_login.php, and pc_login_page.php endpoints.
Session Validation Enhancement
allImplement additional server-side session validation to verify cookie integrity and prevent unauthorized modifications.
🧯 If You Can't Patch
- Isolate the Photo Cart application behind a reverse proxy with strict session validation
- Implement network segmentation to limit access to the vulnerable application
🔍 How to Verify
Check if Vulnerable:
Check if Photo Cart version is 6 or 7 and verify that Security-Patch-2018-B has not been applied. Test by attempting to modify authentication cookies to access other user accounts.Check Version:
Check the Photo Cart administration panel or configuration files for version information.Verify Fix Applied:
After applying the patch, test authentication mechanisms to ensure cookie manipulation no longer allows unauthorized account access. Verify that session validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login with unusual cookie values
- Access to customer accounts from unexpected IP addresses
- Requests to pc_head.php, pc_login.php, or pc_login_page.php with modified cookies
Network Indicators:
- Unusual patterns of cookie manipulation in HTTP requests
- Rapid succession of authentication attempts with varying cookie values
SIEM Query:
source="web_logs" AND (uri="/pc_head.php" OR uri="/pc_login.php" OR uri="/pc_login_page.php") AND cookie_changes>0🔗 References
- https://brianmccarthytech.blogspot.co.nz/2018/04/cve-2018-5190.html
- https://www.picturespro.com/support-forum/photo-cart/?t=38346-security-patch-for-photo-cart-2018
- https://brianmccarthytech.blogspot.co.nz/2018/04/cve-2018-5190.html
- https://www.picturespro.com/support-forum/photo-cart/?t=38346-security-patch-for-photo-cart-2018
