PT-2005-4733 · Zen Cart · Zen Cart

Published 2005-12-05 · Updated 2018-10-19 · CVE-2005-3997

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zen Cart versions 1.2.6d and earlier

Description The issue allows remote attackers to obtain sensitive information via direct requests to certain files in the admin/includes directory. This includes files such as graphs/banner daily.php, graphs/banner infobox.php, graphs/banner yearly.php, graphs/banner monthly.php, application bottom.php, attributes preview.php, modules/category product listing.php, modules/copy to confirm.php, modules/delete product confirm.php, and modules/move product confirm.php. The resulting error message leaks the web server path.

Recommendations For Zen Cart versions 1.2.6d and earlier, restrict access to the admin/includes directory to minimize the risk of exploitation. Consider implementing proper access controls and configuring the web server to prevent direct requests to sensitive files.

Fix

Related Identifiers

CVE-2005-3997

Affected Products

Zen Cart

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2005-3997 · Security Note
• http://osvdb.org/22868 · Note
• http://osvdb.org/22866 · Note
• http://osvdb.org/22875 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3997 · Note
• http://securityfocus.com/archive/1/418995/100/0/threaded · Note
• http://osvdb.org/22871 · Note
• http://osvdb.org/22869 · Note
• http://vupen.com/english/advisories/2005/2728 · Note
• http://osvdb.org/22870 · Note
• http://securityfocus.com/archive/1/418517/100/0/threaded · Note
• http://osvdb.org/22874 · Note
• http://osvdb.org/22873 · Note
• http://osvdb.org/22867 · Note
• http://rgod.altervista.org/zencart_126d_xpl.html · Note