PT-2003-1691 · Early Impact · Productcart

Bosen · Published 2003-07-10 · Updated 2016-10-18 · CVE-2003-0522

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: ProductCart versions 1.5 through 2

Description: The issue allows remote attackers to gain unauthorized access and privileges. This can be achieved through SQL injection vulnerabilities, specifically by manipulating the idadmin parameter to login.asp or the Email parameter to Custva.asp.

Recommendations: For ProductCart versions 1.5 through 2, consider restricting access to the login.asp and Custva.asp pages until a fix is available. As a temporary workaround, avoid using the idadmin and Email parameters in the affected API endpoints.

Fix

Related Identifiers

CVE-2003-0522

Affected Products

Productcart

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2003-0522 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0522 · Note
• http://marc.info/?l=bugtraq&m=105733145930031&w=2 · Note
• http://marc.info/?l=bugtraq&m=105760660928715&w=2 · Note