PT-2006-3741 · Ashopkart · Ashopkart

Soltan_Defacer · Published 2006-06-05 · Updated 2018-10-18 · CVE-2006-2823

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ashopKart 2.0 (aka ashopKart20)

Description The issue allows remote attackers to download a database due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request for specific files, such as 'admin/scart.mdb' and possibly 'admin/scart97.mdb'.

Recommendations For ashopKart 2.0, restrict access to the admin/scart.mdb and admin/scart97.mdb files to prevent unauthorized downloads. Consider implementing proper access controls for sensitive information stored under the web root. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-2823

Affected Products

Ashopkart

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-2823 · Security Note
• http://secunia.com/advisories/20485 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15599 · Note
• http://securitytracker.com/id?1009549 · Note
• http://osvdb.org/26237 · Note
• http://vupen.com/english/advisories/2006/2208 · Note
• http://securityreason.com/securityalert/1025 · Note
• http://securityfocus.com/archive/1/435746/100/0/threaded · Note