PT-2006-7002 · Opensolution · Open Solution Quick.Cart

Publicado 2006-12-08 · Atualizado 2008-09-05 · CVE-2006-6391

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Solution Quick.Cart version 2.0

Description The issue allows remote attackers to include arbitrary files via a .. (dot dot) in the config[db type] parameter to API endpoints such as "actions admin/other.php" and "actions client/gallery.php", particularly when register globals is enabled and magic quotes gpc is disabled.

Recommendations For Open Solution Quick.Cart version 2.0, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the "actions admin/other.php" and "actions client/gallery.php" API endpoints to minimize the risk of including arbitrary files via the config[db type] parameter.

Exploit

Correção

Identificadores relacionados

CVE-2006-6391

Produtos afetados

Open Solution Quick.Cart

Referências · 4

• 🔥 https://exploit-db.com/exploits/2769 · Exploit
• 🔥 http://secunia.com/advisories/23168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6391 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6391 · Nota