PT-2005-3382 · Naxtor · Naxtor Shopping Cart

John Cobb · Publicado 2005-08-05 · Atualizado 2017-07-11 · CVE-2005-2477

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Naxtor Shopping Cart version 1.0

Description The issue allows remote attackers to obtain sensitive information. This is possibly due to an SQL injection vulnerability, where an error message reveals the path when a cat id with a single quote is used.

Recommendations For Naxtor Shopping Cart version 1.0, consider validating and sanitizing user input to prevent SQL injection attacks, and avoid displaying sensitive information in error messages. As a temporary workaround, restrict access to the shop display products.php file until a patch is available.

Correção

Identificadores relacionados

CVE-2005-2477

Produtos afetados

Naxtor Shopping Cart

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-2477 · Nota de Segurança
• http://secunia.com/advisories/16262 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21677 · Nota
• http://securityfocus.com/bid/14456 · Nota
• http://securitytracker.com/id?1014613 · Nota
• http://marc.info/?l=bugtraq&m=112301600608192&w=2 · Nota