PT-2004-2917 · Oscommerce · Oscommerce

L0Om · Published 2004-12-31 · Updated 2024-02-14 · CVE-2004-2021

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions osCommerce version 2.2

Description A directory traversal issue exists, allowing remote attackers to view arbitrary files by including a .. (dot dot) in the filename argument of the file manager.php script.

Recommendations For osCommerce version 2.2, update the file manager.php script to properly sanitize the filename argument and prevent directory traversal attacks. As a temporary workaround, consider restricting access to the file manager.php script until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2004-2021

Affected Products

Oscommerce

References · 11

• 🔥 https://exploit-db.com/exploits/24126 · Exploit
• 🔥 http://securityfocus.com/bid/10364 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2021 · Security Note
• http://securitytracker.com/id?1010176 · Note
• http://excluded.org/advisories/advisory13.txt · Note
• http://archives.neohapsis.com/archives/bugtraq/2005-03/0378.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2021 · Note
• http://secunia.com/advisories/11624 · Note
• http://osvdb.org/6308 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16174 · Note
• http://marc.info/?l=bugtraq&m=108482902101519&w=2 · Note