PT-2006-2678 · Ecotwo · Ecotwo Shopsystem

Published 2006-04-10 · Updated 2008-11-03 · CVE-2006-1684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ecotwo Shopsystem versions 1.0-192 and earlier

Description: The issue allows remote attackers to include arbitrary local files. This can be achieved via the lang parameter in "news.php" and other unspecified vectors.

Recommendations: For versions 1.0-192 and earlier, consider restricting access to the "news.php" file and avoid using the lang parameter until a fix is available. Additionally, restrict access to other potentially vulnerable components to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1684

Affected Products

Ecotwo Shopsystem

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2006-1684 · Security Note
• http://pridels0.blogspot.com/2006/04/ecotwo-shopsystem-vuln.html · Note