PT-2004-2917 · Oscommerce · Oscommerce

L0Om · Publicado 2004-12-31 · Atualizado 2024-02-14 · CVE-2004-2021

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions osCommerce version 2.2

Description A directory traversal issue exists, allowing remote attackers to view arbitrary files by including a .. (dot dot) in the filename argument of the file manager.php script.

Recommendations For osCommerce version 2.2, update the file manager.php script to properly sanitize the filename argument and prevent directory traversal attacks. As a temporary workaround, consider restricting access to the file manager.php script until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2004-2021

Produtos afetados

Oscommerce

Referências · 11

• 🔥 https://exploit-db.com/exploits/24126 · Exploit
• 🔥 http://securityfocus.com/bid/10364 · Exploit
• http://securitytracker.com/id?1010176 · Nota
• http://excluded.org/advisories/advisory13.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2021 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2005-03/0378.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2021 · Nota
• http://secunia.com/advisories/11624 · Nota
• http://osvdb.org/6308 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16174 · Nota
• http://marc.info/?l=bugtraq&m=108482902101519&w=2 · Nota