PT-2006-7002 · Opensolution · Open Solution Quick.Cart

Published 2006-12-08 · Updated 2008-09-05 · CVE-2006-6391

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Solution Quick.Cart version 2.0

Description The issue allows remote attackers to include arbitrary files via a .. (dot dot) in the config[db type] parameter to API endpoints such as "actions admin/other.php" and "actions client/gallery.php", particularly when register globals is enabled and magic quotes gpc is disabled.

Recommendations For Open Solution Quick.Cart version 2.0, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the "actions admin/other.php" and "actions client/gallery.php" API endpoints to minimize the risk of including arbitrary files via the config[db type] parameter.

Exploit

Fix

Related Identifiers

CVE-2006-6391

Affected Products

Open Solution Quick.Cart

References · 4

• 🔥 https://exploit-db.com/exploits/2769 · Exploit
• 🔥 http://secunia.com/advisories/23168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6391 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6391 · Note