PT-2002-2520 · Midicart · Php Maxi+2

Published 2002-12-31 · Updated 2024-01-25 · CVE-2002-1798

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MidiCart PHP, PHP Plus, and PHP Maxi (affected versions not specified)

Description The issue allows remote attackers to upload arbitrary PHP files via a direct request to "admin/upload.php" or access sensitive information via a direct request to "admin/credit card info.php".

Recommendations For MidiCart PHP, consider disabling access to the "admin/upload.php" endpoint until a fix is available. For PHP Plus, restrict access to the "admin/credit card info.php" endpoint to minimize the risk of exploitation. For PHP Maxi, avoid using direct requests to sensitive endpoints like "admin/upload.php" and "admin/credit card info.php" until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2002-1798

Affected Products

Midicart Php

Php Maxi

Php Plus

References · 8

• 🔥 http://securityfocus.com/bid/5851 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html · Exploit
• 🔥 https://exploit-db.com/exploits/21894 · Exploit
• 🔥 http://securityfocus.com/bid/5855 · Exploit
• 🔥 https://exploit-db.com/exploits/21896 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1798 · Security Note
• https://t.me/cvenotify/68739 · Telegram Post
• http://iss.net/security_center/static/10306.php · Note