PT-2005-1504 · Cubecart · Cubecart

John Cobb · Publicado 2005-02-15 · Atualizado 2017-07-11 · CVE-2005-0443

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CubeCart version 2.0.4

Description The issue allows remote attackers to either obtain the full path for the web server or conduct cross-site scripting (XSS) attacks. This is achieved via an invalid language parameter in index.php, which echoes the parameter in a PHP error message, potentially leading to XSS attacks or information disclosure.

Recommendations For CubeCart version 2.0.4, consider validating and sanitizing the language parameter to prevent echoing of invalid input, and restrict access to error messages that could disclose sensitive information. As a temporary workaround, consider disabling the language parameter functionality in index.php until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2005-0443

Produtos afetados

Cubecart

Referências · 8

• 🔥 http://securityfocus.com/bid/12549 · Exploit
• 🔥 https://exploit-db.com/exploits/25097 · Exploit
• http://marc.info/?l=bugtraq&m=110842125901191&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0443 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0443 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19328 · Nota
• http://osvdb.org/14064 · Nota
• http://cubecart.com/site/forums/index.php?showtopic=5741 · Aviso do Fabricante