PT-2004-1454 · Unknown · Online Store Kit

Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0300

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Online Store Kit version 3.0

Description The issue allows remote attackers to inject arbitrary SQL and gain unauthorized access. This can be achieved via several parameters in different PHP files, including the cat parameter in "shop.php", the id parameter in "more.php", the cat manufacturer parameter in "shop by brand.php", or the id parameter in "listing.php".

Recommendations For Online Store Kit version 3.0, consider restricting access to the vulnerable parameters cat, id, and cat manufacturer in the respective PHP files until a patch is available. As a temporary workaround, disabling the SQL injection vulnerability by input validation and sanitization is recommended.

Exploit

Fix

Related Identifiers

CVE-2004-0300

Affected Products

Online Store Kit

References · 14

• 🔥 https://exploit-db.com/exploits/23711 · Exploit
• 🔥 https://exploit-db.com/exploits/23719 · Exploit
• 🔥 https://exploit-db.com/exploits/23718 · Exploit
• 🔥 http://securityfocus.com/bid/9676 · Exploit
• 🔥 https://exploit-db.com/exploits/23720 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0300 · Security Note
• http://securityfocus.com/bid/9687 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=107712117913185&w=2 · Note
• http://secunia.com/advisories/10902 · Note
• http://zone-h.org/en/advisories/read/id=3972 · Note
• http://osvdb.org/3973 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15232 · Note
• http://securitytracker.com/alerts/2004/Feb/1009092.html · Note
• http://systemsecure.org/advisories/ssadvisory16022004.php · Note