WebStore2000 SQL Injection Vulnerability & Exploit

1ndonesian Security Team 1st http://bosen.net/releases/ ======================================================================= ======================= Security Advisory Advisory Name: WebStore SQL Injection Vulnerability & Exploit Release Date: 05/10/2003 Application: WebStore2000 Version 6.0/ f...

CVE-2001-1343

wsmail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter...

CVE-2001-1344

CVE-2001-1344 concerns WSSecurity.pl in WebStore, where authentication can be bypassed by supplying a filename that exists, aided by a null character or a .. traversal. Affected is WebStore’s WSSecurity.pl component; the underlying issue is improper handling of user-supplied filenames enabling by...

CVE-2001-1344

WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is made easier by 1 inserting a null character or 2 .. dot dot...

CVE-2001-1343

CVE-2001-1343 affects WebStore 400/400CS 4.14 via ws_mail.cgi. The vulnerability allows remote authenticated WebStore administrators to execute arbitrary code by supplying shell metacharacters in the kill parameter. The CVSS metrics indicate network access with low attack complexity and no authen...

bug

Hi, I'm reposting a bug I've found some time before. Thanks WebStore from www.cgicentral.net is a shopping cart allowing users to buy things on-line. One of the scripts in the package, wsmail.cgi unsafely passes user-submitted data to 'system' command: if $in'terminate' eval system"kill $in'kill'...

CVE-2001-1343

wsmail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter...

CVE-2001-1344

WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is made easier by 1 inserting a null character or 2 .. dot dot...

cgiCentral WebStore 400 - Arbitrary Command Execution

cgiCentral WebStore 400 - Arbitrary Command Execution source: https://www.securityfocus.com/bid/2861/info cgiCentral's Webstore is an shopping cart application which processes and manages online purchases. Wsmail.cgi calls system with user-supplied data in the command string. Because it does not...

cgiCentral WebStore 400 - Administrator Authentication Bypass

cgiCentral WebStore 400 - Administrator Authentication Bypass source: https://www.securityfocus.com/bid/2860/info cgiCentral's Webstore is an shopping cart application which processes and manages online purchases. A vulnerability exists in Webstore which may allow attackers to obtain administrati...

cgiCentral WebStore 400 - Administrator Authentication Bypass

source: https://www.securityfocus.com/bid/2860/info cgiCentral's Webstore is an shopping cart application which processes and manages online purchases. A vulnerability exists in Webstore which may allow attackers to obtain administrative privileges. The vulnerability is due to a lack of filtering...

cgiCentral WebStore 400 - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/2861/info cgiCentral's Webstore is an shopping cart application which processes and manages online purchases. Wsmail.cgi calls system with user-supplied data in the command string. Because it does not filter metacharacters out of the user-supplied data, i...

CVE-2000-1005

The CVE-2000-1005 entry concerns directory traversal in eXtropia WebStore CGI scripts (html_web_store.cgi and web_store.cgi). An attacker can read arbitrary files by supplying a .. (dot dot) path in the page parameter, enabling remote file disclosure. The vulnerability is evidenced by multiple so...

CVE-2000-1005

Directory traversal vulnerability in htmlwebstore.cgi and webstore.cgi CGI programs in eXtropia WebStore allows remote attackers to read arbitrary files via a .. dot dot attack on the page parameter...

CVE-2000-1005

Directory traversal vulnerability in htmlwebstore.cgi and webstore.cgi CGI programs in eXtropia WebStore allows remote attackers to read arbitrary files via a .. dot dot attack on the page parameter...

Security Advisory : eXtropia WebStore (web_store.cgi) Directory Traversal Vulnerability

October 9, 2000 Security Advisory webstore.cgi.ad-1.00-10 : eXtropia WebStore webstore.cgi Directory Traversal Vulnerability Affected Product/Version: eXtropia WebStore webstore.cgi/htmlwebstore.cgi Affected Platforms: Unix Windows Overview: The Web Store is a shopping cart product by eXtropia...

extropia webstore 1.0/2.0 - Directory Traversal

source: https://www.securityfocus.com/bid/1774/info Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript. The routine webstore.cgi does not properly handle the $fileextension...

extropia webstore 1.02.0 - Directory Traversal

extropia webstore 1.02.0 - Directory Traversal source: https://www.securityfocus.com/bid/1774/info Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript. The routine webstore.cgi...

CVE-1999-0604

An incorrect configuration of the WebStore 1.0 shopping cart CGI program "webstore.cgi" could disclose private information...

CVE-1999-0604

The CVE-1999-0604 entry refers to an incorrect configuration in the WebStore 1.0 shopping cart CGI program (web_store.cgi) that could disclose private information. Connected sources (Red Hat CVE page, CVE lists, EUVD entry) corroborate the same description. No patches or remediation details are p...