PT-2007-5620 · Squirrelcart · Squirrelcart

Shai Magal · Publicado 2007-08-21 · Atualizado 2017-09-29 · CVE-2007-4439

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Squirrelcart versions 1.x.x and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the site isp root parameter, probably related to cart.php. This can be exploited by providing a malicious URL to the vulnerable parameter, potentially leading to the execution of arbitrary code.

Recommendations For Squirrelcart versions 1.x.x and earlier, restrict access to the popup window.php file and avoid using the site isp root parameter until a fix is available. As a temporary workaround, consider validating and sanitizing all input to the site isp root parameter to prevent malicious URLs from being executed.

Exploit

Correção

Identificadores relacionados

CVE-2007-4439

Produtos afetados

Squirrelcart

Referências · 6

• 🔥 https://exploit-db.com/exploits/4295 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4439 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36112 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4439 · Nota de Segurança
• http://osvdb.org/37701 · Nota
• http://securityfocus.com/bid/25382 · Nota