profitcode software payprocart 3.0 - Directory Traversal Vulnerability

2005-04-05T00:00:00
ID EDB-ID:25338
Type exploitdb
Reporter Diabolic Crab
Modified 2005-04-05T00:00:00

Description

ProfitCode Software PayProCart 3.0 Directory Traversal Vulnerability. CVE-2005-1005. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/13006/info

ProfitCode Software PayProCart may allow a remote attacker to carry out directory traversal attacks.

It is reported that this issue can be exploited by issuing a specially crafted HTTP GET request and supplying directory traversal sequences followed by a target file name through an affected parameter.

Reportedly, the attacker can gain access to file owned by the administrator and gain administrative access to the application by accessing the administrative panel. The attacker is able to gain access to the administrative panel without providing authentication credentials.

PayProCart versions 3.0 is affected by this issue. Other versions may be affected as well. 

http://www.example.com/adminshop/index.php?proMod=index&amp%3bftoedit=..%2fshopincs%2fmaintopENG