PT-2006-5107 · Oscommerce · Oscommerce

Publicado 2006-08-23 · Atualizado 2017-07-20 · CVE-2006-4298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions osCommerce versions prior to 2.2 Milestone 2 060817

Description The issue allows remote attackers to determine the existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep cache also purchased, (2) tep cache manufacturers box, and (3) tep cache categories box functions.

Recommendations For osCommerce versions prior to 2.2 Milestone 2 060817, update to version 2.2 Milestone 2 060817 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-4298

Produtos afetados

Oscommerce

Referências · 5

• 🔥 http://gulftech.org/?node=research&article_id=00110-08172006 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28435 · Nota
• http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4298 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4298 · Nota de Segurança