PT-2006-5656 · X Cart · X-Cart

Publicado 2006-09-21 · Atualizado 2017-07-20 · CVE-2006-4904

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions X-Cart versions 4.1.3 and earlier

Description A dynamic variable evaluation issue allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code. This can be achieved through PHP remote file inclusion via the xcart dir parameter.

Recommendations For X-Cart versions 4.1.3 and earlier, avoid using the xcart dir parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-4904

Produtos afetados

X-Cart

Referências · 7

• 🔥 https://exploit-db.com/exploits/43842 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29005 · Nota
• http://secunia.com/advisories/22005 · Nota
• http://securityfocus.com/bid/20108 · Nota
• http://vupen.com/english/advisories/2006/3692 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4904 · Nota de Segurança
• http://gulftech.org/?node=research&article_id=00113-09182006& · Nota