PT-2003-2445 · Cpcommerce · Cpcommerce

Astharot · Publicado 2003-12-31 · Atualizado 2025-01-21 · CVE-2003-1500

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cpCommerce version 0.5f

Description The issue allows remote attackers to execute arbitrary code via the prefix parameter in the functions.php file. This is a result of a remote file inclusion vulnerability.

Recommendations For cpCommerce version 0.5f, consider restricting access to the functions.php file or the prefix parameter to minimize the risk of exploitation. Avoid using the prefix parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2003-1500

Produtos afetados

Cpcommerce

Referências · 10

• https://t.me/cvenotify/68907 · Publicação no Telegram
• https://t.me/cvenotify/108043 · Publicação no Telegram
• http://securityfocus.com/archive/1/341757 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13457 · Nota
• http://cpcommerce.org/forums/index.php?board=2%3Baction=display%3Bthreadid=864 · Nota
• http://securityfocus.com/bid/8851 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1500 · Nota de Segurança
• http://securiteam.com/unixfocus/6H00E2K8KG.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1500 · Nota
• http://securityreason.com/securityalert/3301 · Nota