PT-2008-1811 · Webasyst · Shop-Script

Fisher762 · Publicado 2008-01-09 · Atualizado 2017-09-29 · CVE-2008-0158

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shop-Script versions 2.0 and possibly other versions

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the aux page parameter in the index.php file.

Recommendations For Shop-Script version 2.0, consider restricting access to the aux page parameter in the index.php file until a patch is available. As a temporary workaround, avoid using the aux page parameter with .. (dot dot) sequences in the index.php file to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0158

Produtos afetados

Shop-Script

Referências · 5

• 🔥 http://packetstormsecurity.org/0801-exploits/shopscript-disclose.txt · Exploit
• 🔥 https://exploit-db.com/exploits/4855 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39449 · Nota
• http://securityfocus.com/bid/27165 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0158 · Nota de Segurança