Brooky CubeCart漏洞

Brooky CubeCart漏洞

漏洞ID 1108456 漏洞类型 跨站脚本
发布时间 2005-02-14 更新时间 2005-10-20
图片[1]-Brooky CubeCart漏洞-安全小百科CVE编号 CVE-2005-0443
图片[2]-Brooky CubeCart漏洞-安全小百科CNNVD-ID CNNVD-200505-028
漏洞平台 PHP CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/25097
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-028
|漏洞详情
CubeCart2.0.4的index.php允许远程攻击者通过无效的语言参数(1)获取Web服务器的完整路径或者(2)执行跨站脚本(XSS)攻击,并在PHP出错信息中输出参数。
|漏洞EXP
source: http://www.securityfocus.com/bid/12549/info

Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.

The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.

The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.

CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. 

http://www.example.com/index.php?&language=<script>var%20test_variable=31
337;alert(test_variable);</script>
|参考资料

来源:BID
名称:12549
链接:http://www.securityfocus.com/bid/12549
来源:www.cubecart.com
链接:http://www.cubecart.com/site/forums/index.php?showtopic=5741
来源:XF
名称:cubecart-index-xss(19328)
链接:http://xforce.iss.net/xforce/xfdb/19328
来源:BUGTRAQ
名称:20050214[NOBYTES.COM:#2]CubeCart2.0.4-MultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110842125901191&w;=2
来源:OSVDB
名称:14064
链接:http://www.osvdb.org/14064

相关推荐: YaST2 Utility Library File Verification Shell Code Injection Vulnerability

YaST2 Utility Library File Verification Shell Code Injection Vulnerability 漏洞ID 1098134 漏洞类型 Design Error 发布时间 2004-08-04 更新时间 200…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享