PT-2003-2213 · A · Ashopkart

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1268

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions a.shopKart version 2.0.3

Description The issue allows remote attackers to execute arbitrary SQL and obtain sensitive information. This is achieved through SQL injection vulnerabilities in the addcustomer.asp, addprod.asp, and process.asp files. The zip, state, country, phone, and fax parameters are vulnerable to this type of attack.

Recommendations For a.shopKart version 2.0.3, consider restricting access to the vulnerable parameters zip, state, country, phone, and fax in the affected files until a patch is available. As a temporary workaround, avoid using these parameters in the addcustomer.asp, addprod.asp, and process.asp files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2003-1268

Affected Products

Ashopkart

References · 10

• http://securityfocus.com/archive/1/305685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1268 · Security Note
• http://centaura.com.ar/infosec/adv/ashopkart.txt · Note
• http://securityfocus.com/bid/6558 · Note
• http://securitytracker.com/id?1005903 · Note
• http://osvdb.org/37037 · Note
• http://osvdb.org/37038 · Note
• http://secunia.com/advisories/7838 · Note
• http://iss.net/security_center/static/11029.php · Note
• http://osvdb.org/37036 · Note