PT-2003-2445 · Cpcommerce · Cpcommerce

Astharot · Published 2003-12-31 · Updated 2025-01-21 · CVE-2003-1500

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cpCommerce version 0.5f

Description The issue allows remote attackers to execute arbitrary code via the prefix parameter in the functions.php file. This is a result of a remote file inclusion vulnerability.

Recommendations For cpCommerce version 0.5f, consider restricting access to the functions.php file or the prefix parameter to minimize the risk of exploitation. Avoid using the prefix parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2003-1500

Affected Products

Cpcommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2003-1500 · Security Note
• https://t.me/cvenotify/68907 · Telegram Post
• https://t.me/cvenotify/108043 · Telegram Post
• http://securityfocus.com/archive/1/341757 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13457 · Note
• http://cpcommerce.org/forums/index.php?board=2%3Baction=display%3Bthreadid=864 · Note
• http://securityfocus.com/bid/8851 · Note
• http://securiteam.com/unixfocus/6H00E2K8KG.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1500 · Note
• http://securityreason.com/securityalert/3301 · Note