PT-2013-3150 · Cubecart · Cubecart

Egidio Romano + 1 · Published 2013-02-08 · Updated 2024-01-09 · CVE-2013-1465

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CubeCart versions 5.0.0 through 5.2.0

Description The issue allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter. This can be used to modify the application configuration using the Config object.

Recommendations For CubeCart versions 5.0.0 through 5.2.0, consider disabling the Cubecart:: basket method until a patch is available. Restrict access to the classes/cubecart.class.php file to minimize the risk of exploitation. Avoid using the shipping parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2013-1465

Affected Products

Cubecart

References · 13

• 🔥 http://exploit-db.com/exploits/24465 · Exploit
• 🔥 http://karmainsecurity.com/KIS-2013-02 · Exploit
• 🔥 http://packetstormsecurity.com/files/120094/CubeCart-5.2.0-PHP-Object-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/24465 · Exploit
• http://forums.cubecart.com/?showtopic=47026 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-1465 · Security Note
• http://secunia.com/advisories/52072 · Note
• http://osvdb.org/89923 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1465 · Note
• http://securityfocus.com/bid/57770 · Note
• http://archives.neohapsis.com/archives/bugtraq/2013-02/0032.html · Note
• https://t.me/cvenotify/66701 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81920 · Note