PT-2005-2055 · Cubecart · Cubecart

John Cobb · Publicado 2005-04-09 · Atualizado 2016-10-18 · CVE-2005-1033

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CubeCart version 2.0.6

Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different PHP files, including the language parameter to "index.php", the PHPSESSID parameter to "index.php", the product parameter to "tellafriend.php", the add parameter to "view cart.php", or the product parameter to "view product.php". This reveals the path in a PHP error message.

Recommendations For CubeCart version 2.0.6, consider restricting access to the mentioned PHP files or validating the language, PHPSESSID, product, and add parameters to prevent the disclosure of sensitive information. As a temporary workaround, consider disabling the display of PHP error messages to minimize the risk of path disclosure.

Exploit

Correção

Identificadores relacionados

CVE-2005-1033

Produtos afetados

Cubecart

Referências · 9

• 🔥 https://exploit-db.com/exploits/25358 · Exploit
• 🔥 https://exploit-db.com/exploits/25356 · Exploit
• 🔥 https://exploit-db.com/exploits/25357 · Exploit
• 🔥 https://exploit-db.com/exploits/25355 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1033 · Nota
• http://marc.info/?l=bugtraq&m=111281457918479&w=2 · Nota
• http://osvdb.org/14064 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1033 · Nota de Segurança
• http://securitytracker.com/id?1013660 · Nota