JVN#15973066: EC-CUBE vulnerable to directory traversal when used in Windows

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability when used in Windows.

Impact

A remote attacker may obtain arbitrary files on the server.

Solution

Apply the update or patch
Apply the update or patch according to the information provided by the developer.

Products Affected

Versions listed below are vulnerable when used in Windows.

• EC-CUBE 2.12.0
• EC-CUBE 2.12.1
• EC-CUBE 2.12.2
• EC-CUBE 2.12.3
• EC-CUBE 2.12.3en
• EC-CUBE 2.12.3enP1
• EC-CUBE 2.12.3enP2
• EC-CUBE 2.12.4
• EC-CUBE 2.12.4en
• EC-CUBE 2.12.5
• EC-CUBE 2.12.5en