PT-2007-5323 · E Commerce Scripts · Multi-Vendor E-Shop Script+2

Publicado 2007-08-01 · Atualizado 2018-10-15 · CVE-2007-4121

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions E-Commerce Scripts Shopping Cart Script (affected versions not specified) Multi-Vendor E-Shop Script (affected versions not specified) Auction Script (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the EmailAdd (Username) and Pass (password) parameters in the "admin.aspx" page.

Recommendations For E-Commerce Scripts Shopping Cart Script, restrict access to the admin.aspx page until a fix is available. For Multi-Vendor E-Shop Script, avoid using the EmailAdd and Pass parameters in the affected page until the issue is resolved. For Auction Script, consider disabling the admin.aspx page as a temporary workaround until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-4121

Produtos afetados

Auction Script

E-Commerce Scripts Shopping Cart Script

Multi-Vendor E-Shop Script

Referências · 7

• 🔥 http://outlaw.aria-security.info/?p=11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4121 · Nota de Segurança
• http://securityfocus.com/archive/1/475062/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35680 · Nota
• http://secunia.com/advisories/26277 · Aviso do Fabricante
• http://securityfocus.com/bid/25125 · Aviso do Fabricante
• http://securityreason.com/securityalert/2944 · Nota