PT-2006-7001 · Opensolution+1 · Open Solution Quick.Cart+1

R0Ut3R · Publicado 2006-12-08 · Atualizado 2017-10-19 · CVE-2006-6390

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Solution Quick.Cart version 2.0

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db type] parameter to various PHP scripts, including "categories.php", "couriers.php", "orders.php", and "products.php" in "actions admin/" and "orders.php" and "products.php" in "actions client/". This can be exploited by injecting PHP sequences into an Apache HTTP Server log file, which is then included by one of these PHP scripts. The exploitation is possible when register globals is enabled and magic quotes gpc is disabled.

Recommendations For Open Solution Quick.Cart version 2.0, consider disabling the register globals setting and enabling magic quotes gpc to prevent exploitation. Additionally, restrict access to the vulnerable PHP scripts in "actions admin/" and "actions client/" directories until a patch is available. Avoid using the config[db type] parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-6390

Produtos afetados

Apache Http Server

Open Solution Quick.Cart

Referências · 7

• 🔥 http://securityfocus.com/bid/21411 · Exploit
• 🔥 https://exploit-db.com/exploits/2889 · Exploit
• http://vupen.com/english/advisories/2006/4835 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6390 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6390 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30698 · Nota
• http://secunia.com/advisories/23168 · Aviso do Fabricante