PT-2006-3741 · Ashopkart · Ashopkart

Soltan_Defacer · Publicado 2006-06-05 · Atualizado 2018-10-18 · CVE-2006-2823

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ashopKart 2.0 (aka ashopKart20)

Description The issue allows remote attackers to download a database due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request for specific files, such as 'admin/scart.mdb' and possibly 'admin/scart97.mdb'.

Recommendations For ashopKart 2.0, restrict access to the admin/scart.mdb and admin/scart97.mdb files to prevent unauthorized downloads. Consider implementing proper access controls for sensitive information stored under the web root. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-2823

Produtos afetados

Ashopkart

Referências · 8

• http://secunia.com/advisories/20485 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15599 · Nota
• http://securitytracker.com/id?1009549 · Nota
• http://osvdb.org/26237 · Nota
• http://vupen.com/english/advisories/2006/2208 · Nota
• http://securityreason.com/securityalert/1025 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2823 · Nota de Segurança
• http://securityfocus.com/archive/1/435746/100/0/threaded · Nota