PT-2004-1454 · Unknown · Online Store Kit

Publicado 2004-03-18 · Atualizado 2017-07-11 · CVE-2004-0300

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Online Store Kit version 3.0

Description The issue allows remote attackers to inject arbitrary SQL and gain unauthorized access. This can be achieved via several parameters in different PHP files, including the cat parameter in "shop.php", the id parameter in "more.php", the cat manufacturer parameter in "shop by brand.php", or the id parameter in "listing.php".

Recommendations For Online Store Kit version 3.0, consider restricting access to the vulnerable parameters cat, id, and cat manufacturer in the respective PHP files until a patch is available. As a temporary workaround, disabling the SQL injection vulnerability by input validation and sanitization is recommended.

Exploit

Correção

Identificadores relacionados

CVE-2004-0300

Produtos afetados

Online Store Kit

Referências · 14

• 🔥 https://exploit-db.com/exploits/23711 · Exploit
• 🔥 https://exploit-db.com/exploits/23719 · Exploit
• 🔥 https://exploit-db.com/exploits/23718 · Exploit
• 🔥 http://securityfocus.com/bid/9676 · Exploit
• 🔥 https://exploit-db.com/exploits/23720 · Exploit
• http://marc.info/?l=bugtraq&m=107712117913185&w=2 · Nota
• http://secunia.com/advisories/10902 · Nota
• http://zone-h.org/en/advisories/read/id=3972 · Nota
• http://osvdb.org/3973 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15232 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0300 · Nota de Segurança
• http://securityfocus.com/bid/9687 · Aviso do Fabricante
• http://securitytracker.com/alerts/2004/Feb/1009092.html · Nota
• http://systemsecure.org/advisories/ssadvisory16022004.php · Nota