PT-2005-1504 · Cubecart · Cubecart

John Cobb · Published 2005-02-15 · Updated 2017-07-11 · CVE-2005-0443

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CubeCart version 2.0.4

Description The issue allows remote attackers to either obtain the full path for the web server or conduct cross-site scripting (XSS) attacks. This is achieved via an invalid language parameter in index.php, which echoes the parameter in a PHP error message, potentially leading to XSS attacks or information disclosure.

Recommendations For CubeCart version 2.0.4, consider validating and sanitizing the language parameter to prevent echoing of invalid input, and restrict access to error messages that could disclose sensitive information. As a temporary workaround, consider disabling the language parameter functionality in index.php until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-0443

Affected Products

Cubecart

References · 8

• 🔥 http://securityfocus.com/bid/12549 · Exploit
• 🔥 https://exploit-db.com/exploits/25097 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0443 · Security Note
• http://cubecart.com/site/forums/index.php?showtopic=5741 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110842125901191&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0443 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19328 · Note
• http://osvdb.org/14064 · Note