PT-2008-4970 · Magicscripts · Magicscripts E-Store Kit-1 Pro Paypal Edition+3

Mr.Sql · Published 2008-08-11 · Updated 2017-09-29 · CVE-2008-3594

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MagicScripts E-Store Kit-1 (affected versions not specified) MagicScripts E-Store Kit-2 (affected versions not specified) MagicScripts E-Store Kit-1 Pro PayPal Edition (affected versions not specified) MagicScripts E-Store Kit-2 PayPal Edition (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the pid parameter in the viewdetails.php file.

Recommendations For MagicScripts E-Store Kit-1, consider restricting access to the viewdetails.php file until a fix is available. For MagicScripts E-Store Kit-2, avoid using the pid parameter in the viewdetails.php file until the issue is resolved. For MagicScripts E-Store Kit-1 Pro PayPal Edition, restrict the use of the viewdetails.php file to minimize the risk of exploitation. For MagicScripts E-Store Kit-2 PayPal Edition, as a temporary workaround, consider disabling the viewdetails.php file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-3594

Affected Products

Magicscripts E-Store Kit-1

Magicscripts E-Store Kit-1 Pro Paypal Edition

Magicscripts E-Store Kit-2

Magicscripts E-Store Kit-2 Paypal Edition

References · 6

• 🔥 https://exploit-db.com/exploits/6193 · Exploit
• 🔥 http://securityfocus.com/bid/30524 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3594 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44159 · Note
• http://securityreason.com/securityalert/4139 · Note
• http://secunia.com/advisories/31273 · Note