Очередные дырки в различных Shopping Cart

Обратный путь в директориях позволяет обращаться к системным файлам. В отдельных случаях возможна модификация прайса...

shop.pl.txt

Hassan Consulting's Shopping Cart Version 1.x shopping cart issues. Simple Path disclosure, directory transversal with file read ability, and listing of files in all directorys in somecases. Just depends on version of the code. VENDOR of SHOP.pl --^ Multiple holes at various patchlevels...

Cgisecurity Quickstore Shopping cart

Now i already released this on my site but i forgot to post to bugtraq somehow. Vendor was contacted and i waited awhile for a response and got none back. Upgrade to the newest version for a fix. -zenomorph ps. check bugtraq for older holes in the same product Cgi Security Advisory 1...

CVE-2000-1223

quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET request...

CVE-2000-0282

TalentSoft webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a .. dot dot attack on the webplus CGI program...

CVE-2000-0635

The viewpage.html sample page in the MiniVend shopping cart program allows remote attackers to execute arbitrary commands via shell metacharacters...

CVE-2000-0635

CVE-2000-0635 concerns the MiniVend shopping cart’s view_page.html. The vulnerability stems from the input to the mv_arg parameter not being properly sanitized, allowing a remote attacker to supply shell metacharacters and execute arbitrary commands on the remote system. The affected component is...

DST2K0036: Price modification possible in CyberOffice Shopping Ca rt

All, We have released this with the permission of the vendor. Rgds Ollie ----- Ollie Whitehouse Security Team Leader tel: +44 020 79160200 ============================================================================ Delphis Consulting Plc...

Security Advisory: Hassan Consulting's shop.cgi Directory Traversal Vulnerability.

October 7, 2000 Security Advisory shop.cgi.ad-1.00-10 : Hassan Consulting's Shopping Cart shop.cgi Directory Traversal Vulnerability Affected Product: Hassan Consulting's Shopping Cart shop.cgi/shop.pl Version 1.18 possibly others aswell Affected Platforms: Unix Windows Overview: Hassan...

Bytes interactive Web shopper 1.02.0 - Directory Traversal

Bytes interactive Web shopper 1.02.0 - Directory Traversal source: https://www.securityfocus.com/bid/1776/info Bytes Interactive Web Shopper is a XML based shopping cart application. The "newpage" variable does not properly check for insecure relative paths such as the double dot "..". The...

Bytes interactive Web shopper 1.0/2.0 - Directory Traversal

source: https://www.securityfocus.com/bid/1776/info Bytes Interactive Web Shopper is a XML based shopping cart application. The "newpage" variable does not properly check for insecure relative paths such as the double dot "..". The following URL request:...

Hassan Consulting Shopping Cart 1.18 - Directory Traversal

Hassan Consulting Shopping Cart 1.18 - Directory Traversal source: https://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will displa...

Hassan Consulting Shopping Cart 1.18 - Directory Traversal

source: https://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will display the specified file:...

DST2K0036: Price modification possible in CyberOffice Shopping Ca rt

All, We have released this with the permission of the vendor. Rgds Ollie ----- Ollie Whitehouse Security Team Leader tel: +44 020 79160200 ============================================================================ Delphis Consulting Plc...

Дырки в CyberOffice Shopping Cart

Можно поменять стоимость заказа и получить доступ к базе данных сервера...

DST2K0035: Credit card (customer) details exposed within CyberOff ice Shopping Cart v2

All, We have not released this for the past week at the vendors request. This was to enable them to notify all registered users about this vulnerability and to provide a work around. We have taken the unusual step of including the vendors response to our original advisory release in full. This wa...

DST2K0036.txt

============================================================================ Delphis Consulting Plc ============================================================================ Security Team Advisories 22/09/2000 [email protected] http://www.delphisplc.com/thinking/whitepapers/...

DST2K0035.txt

============================================================================ Delphis Consulting Plc ============================================================================ Security Team Advisories 22/09/2000 [email protected] http://www.delphisplc.com/thinking/whitepapers/...

SmartWin CyberOffice Shopping Cart 2.0 - Client Information Disclosure

source: https://www.securityfocus.com/bid/1734/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. It is possible for a remote user to gain read access to the private directory on a website running...

Smartwin Technology CyberOffice Shopping Cart 2.0 - Price Modification

Smartwin Technology CyberOffice Shopping Cart 2.0 - Price Modification source: https://www.securityfocus.com/bid/1733/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. The order form CyberOffice Shoppi...