PT-2005-4733 · Zen Cart · Zen Cart

Publicado 2005-12-05 · Atualizado 2018-10-19 · CVE-2005-3997

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zen Cart versions 1.2.6d and earlier

Description The issue allows remote attackers to obtain sensitive information via direct requests to certain files in the admin/includes directory. This includes files such as graphs/banner daily.php, graphs/banner infobox.php, graphs/banner yearly.php, graphs/banner monthly.php, application bottom.php, attributes preview.php, modules/category product listing.php, modules/copy to confirm.php, modules/delete product confirm.php, and modules/move product confirm.php. The resulting error message leaks the web server path.

Recommendations For Zen Cart versions 1.2.6d and earlier, restrict access to the admin/includes directory to minimize the risk of exploitation. Consider implementing proper access controls and configuring the web server to prevent direct requests to sensitive files.

Correção

Identificadores relacionados

CVE-2005-3997

Produtos afetados

Zen Cart

Referências · 17

• http://osvdb.org/22868 · Nota
• http://osvdb.org/22866 · Nota
• http://osvdb.org/22875 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3997 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3997 · Nota de Segurança
• http://securityfocus.com/archive/1/418995/100/0/threaded · Nota
• http://osvdb.org/22871 · Nota
• http://osvdb.org/22869 · Nota
• http://vupen.com/english/advisories/2005/2728 · Nota
• http://osvdb.org/22870 · Nota
• http://securityfocus.com/archive/1/418517/100/0/threaded · Nota
• http://osvdb.org/22874 · Nota
• http://osvdb.org/22873 · Nota
• http://osvdb.org/22867 · Nota
• http://rgod.altervista.org/zencart_126d_xpl.html · Nota