PT-2007-4166 · Cubecart · Cubecart

Publicado 2007-05-24 · Atualizado 2018-10-16 · CVE-2007-2862

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CubeCart version 3.0.16

Description The issue is related to multiple SQL injection vulnerabilities. These vulnerabilities might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory. The problem is related to missing sanitization of the $option variable and possibly cookie modification.

Recommendations For CubeCart version 3.0.16, consider sanitizing the $option variable to prevent SQL injection attacks. As a temporary workaround, restrict access to the cart.inc.php file and other affected files in the include directory to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-2862

Produtos afetados

Cubecart

Referências · 7

• http://securityfocus.com/archive/1/469301/100/0/threaded · Nota
• http://securityfocus.com/bid/24100 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2862 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2862 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34460 · Nota
• http://osvdb.org/38100 · Nota
• http://securityreason.com/securityalert/2730 · Nota