PT-2007-4600 · Comersus · Comersus Shop Cart

Published 2007-06-21 · Updated 2018-10-16 · CVE-2007-3323

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Comersus Shop Cart version 7.07

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the idProduct parameter in the comersus optReviewReadExec.asp file.

Recommendations For Comersus Shop Cart version 7.07, consider restricting access to the comersus optReviewReadExec.asp file until a patch is available. Avoid using the idProduct parameter in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2007-3323

Affected Products

Comersus Shop Cart

References · 8

• 🔥 https://exploit-db.com/exploits/30203 · Exploit
• 🔥 http://securityfocus.com/bid/24562 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3323 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3323 · Note
• http://osvdb.org/36152 · Note
• http://securityreason.com/securityalert/2819 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34953 · Note
• http://securityfocus.com/archive/1/471837/100/0/threaded · Note