PT-2006-7001 · Opensolution+1 · Open Solution Quick.Cart+1

R0Ut3R · Published 2006-12-08 · Updated 2017-10-19 · CVE-2006-6390

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Solution Quick.Cart version 2.0

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db type] parameter to various PHP scripts, including "categories.php", "couriers.php", "orders.php", and "products.php" in "actions admin/" and "orders.php" and "products.php" in "actions client/". This can be exploited by injecting PHP sequences into an Apache HTTP Server log file, which is then included by one of these PHP scripts. The exploitation is possible when register globals is enabled and magic quotes gpc is disabled.

Recommendations For Open Solution Quick.Cart version 2.0, consider disabling the register globals setting and enabling magic quotes gpc to prevent exploitation. Additionally, restrict access to the vulnerable PHP scripts in "actions admin/" and "actions client/" directories until a patch is available. Avoid using the config[db type] parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-6390

Affected Products

Apache Http Server

Open Solution Quick.Cart

References · 7

• 🔥 http://securityfocus.com/bid/21411 · Exploit
• 🔥 https://exploit-db.com/exploits/2889 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6390 · Security Note
• http://secunia.com/advisories/23168 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4835 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6390 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30698 · Note