PT-2015-5647 · Zeuscart · Zeuscart

Steffen Rösemann · Publicado 2015-03-10 · Atualizado 2015-07-28 · CVE-2015-2183

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZeusCart version 4

Description The issue concerns SQL injection vulnerabilities in the administrative backend. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. This can be achieved through the id parameter in either a disporders detail or subadminmgt edit action, or the cid parameter in an editcurrency action to admin/.

Recommendations For ZeusCart version 4, avoid using the id parameter in disporders detail or subadminmgt edit actions and the cid parameter in editcurrency actions to admin/ until a fix is available. As a temporary workaround, consider restricting access to these parameters to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-2183

Produtos afetados

Zeuscart

Referências · 11

• 🔥 https://exploit-db.com/exploits/36159 · Exploit
• 🔥 http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 http://exploit-db.com/exploits/36159 · Exploit
• 🔥 http://seclists.org/oss-sec/2015/q1/649 · Exploit
• 🔥 http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html · Exploit
• 🔥 http://securityfocus.com/bid/72761 · Exploit
• https://github.com/ZeusCart/zeuscart/issues/28 · Nota
• http://seclists.org/fulldisclosure/2015/Feb/89 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2183 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2183 · Nota
• http://seclists.org/oss-sec/2015/q1/727 · Nota