PT-2005-4739 · Asps · Asps Shopping Cart Lite+1

Published 2005-12-05 · Updated 2008-09-20 · CVE-2005-4003

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ASPS Shopping Cart Professional versions 2.9d and earlier ASPS Shopping Cart Lite versions 2.1 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the srch product name parameter to "adv search.asp" and the b search parameter to "bsearch.asp".

Recommendations For ASPS Shopping Cart Professional versions 2.9d and earlier, consider restricting access to the adv search.asp and bsearch.asp pages until a fix is available. For ASPS Shopping Cart Lite versions 2.1 and earlier, avoid using the srch product name and b search parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-4003

Affected Products

Asps Shopping Cart Lite

Asps Shopping Cart Professional

References · 5

• 🔥 https://exploit-db.com/exploits/26701 · Exploit
• 🔥 https://exploit-db.com/exploits/26702 · Exploit
• 🔥 http://securityfocus.com/bid/15694 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4003 · Security Note
• http://pridels0.blogspot.com/2005/12/asps-shopping-cart-professional-and.html · Note