PT-2005-1654 · Cubecart · Cubecart

Booker + 1 · Publicado 2005-03-01 · Atualizado 2017-07-11 · CVE-2005-0607

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CubeCart versions 2.0.0 through 2.0.5

Description The issue allows remote attackers to determine the full path of the server via direct calls without parameters to various PHP files, including "information.php", "language.php", "list docs.php", "popular prod.php", "sale.php", "subfooter.inc.php", "subheader.inc.php", "cat navi.php", and "check sum.php". This is possible because these files reveal the path in a PHP error message when called directly without parameters.

Recommendations For CubeCart versions 2.0.0 through 2.0.5, consider restricting direct access to the affected PHP files, such as "information.php", "language.php", "list docs.php", "popular prod.php", "sale.php", "subfooter.inc.php", "subheader.inc.php", "cat navi.php", and "check sum.php", to prevent the disclosure of the server path.

Correção

Identificadores relacionados

CVE-2005-0607

Produtos afetados

Cubecart

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0607 · Nota
• http://cubecart.com/site/forums/index.php?showtopic=6032 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2005-0607 · Nota de Segurança
• http://securitytracker.com/id?1013304 · Nota
• http://lostmon.blogspot.com/2005/02/cubecart-20x-multiple-variable-xss.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20638 · Nota