PT-2006-5107 · Oscommerce · Oscommerce

Published 2006-08-23 · Updated 2017-07-20 · CVE-2006-4298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions osCommerce versions prior to 2.2 Milestone 2 060817

Description The issue allows remote attackers to determine the existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep cache also purchased, (2) tep cache manufacturers box, and (3) tep cache categories box functions.

Recommendations For osCommerce versions prior to 2.2 Milestone 2 060817, update to version 2.2 Milestone 2 060817 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2006-4298

Affected Products

Oscommerce

References · 5

• 🔥 http://gulftech.org/?node=research&article_id=00110-08172006 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4298 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28435 · Note
• http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4298 · Note