PT-2006-3143 · Avactis · Avactis Shopping Cart

Publicado 2006-05-04 · Atualizado 2017-07-20 · CVE-2006-2164

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avactis Shopping Cart versions 0.1.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands, which can lead to full path disclosure from invalid SQL queries. This is achieved via the category id parameter in "store special offers.php" and "store.php", and the prod id parameter in "cart.php" and "product info.php".

Recommendations For Avactis Shopping Cart versions 0.1.2 and earlier, consider restricting access to the store special offers.php, store.php, cart.php, and product info.php files until a patch is available. As a temporary workaround, avoid using the category id and prod id parameters in the affected files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2006-2164

Produtos afetados

Avactis Shopping Cart

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26178 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2164 · Nota de Segurança
• http://pridels0.blogspot.com/2006/05/avactis-shopping-cart-vuln.html · Nota
• http://osvdb.org/25639 · Nota
• http://osvdb.org/25637 · Nota
• http://osvdb.org/25638 · Nota
• http://osvdb.org/25640 · Nota