PT-2006-5656 · X Cart · X-Cart

Published 2006-09-21 · Updated 2017-07-20 · CVE-2006-4904

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions X-Cart versions 4.1.3 and earlier

Description A dynamic variable evaluation issue allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code. This can be achieved through PHP remote file inclusion via the xcart dir parameter.

Recommendations For X-Cart versions 4.1.3 and earlier, avoid using the xcart dir parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-4904

Affected Products

X-Cart

References · 7

• 🔥 https://exploit-db.com/exploits/43842 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4904 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29005 · Note
• http://secunia.com/advisories/22005 · Note
• http://securityfocus.com/bid/20108 · Note
• http://vupen.com/english/advisories/2006/3692 · Note
• http://gulftech.org/?node=research&article_id=00113-09182006& · Note