PT-2006-2678 · Ecotwo · Ecotwo Shopsystem

Publicado 2006-04-10 · Atualizado 2008-11-03 · CVE-2006-1684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ecotwo Shopsystem versions 1.0-192 and earlier

Description: The issue allows remote attackers to include arbitrary local files. This can be achieved via the lang parameter in "news.php" and other unspecified vectors.

Recommendations: For versions 1.0-192 and earlier, consider restricting access to the "news.php" file and avoid using the lang parameter until a fix is available. Additionally, restrict access to other potentially vulnerable components to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1684

Produtos afetados

Ecotwo Shopsystem

Referências · 2

• http://pridels0.blogspot.com/2006/04/ecotwo-shopsystem-vuln.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1684 · Nota de Segurança