Pacific Software Carello File Duplication and Source Disclosure Vulnerability

Bugtraq ID:	1245
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	May 24 2000 12:00AM
Updated:	May 24 2000 12:00AM
Credit:	Discovered by Cerberus Security Team <[email protected]> and publicized in a Cerberus Information Security Advisory (CISADV000524b).
Vulnerable:	Pacific Software Carello 1.2.1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

Pacific Software Carello File Duplication and Source Disclosure Vulnerability

A remote user can gain read and write access on a target machine running Carello shopping cart software.

First, a user may create a duplicate of a known file in a known directory on the target host through add.exe in /scripts/Carello. Accessing http://target/scripts/Carello/add.exe?C:\directory\filename.ext will generate a duplicate file with a "1" appended to the filename (eg. filename.ext1). From here, the remote user would perform a http request of the newly created duplicate file and be able to view the contents of it.

This vulnerability depends on the anonymous internet account having write access to the relevant directories.

Pacific Software Carello File Duplication and Source Disclosure Vulnerability

http://target/scripts/Carello/add.exe?C:\directory\filename.ext

Pacific Software Carello File Duplication and Source Disclosure Vulnerability

Solution:
Carello is no longer supported by Pacific Software. However, a new version of the product is expected to be released within the next couple of months which will have this vulnerability rectified.

Pacific Software Carello File Duplication and Source Disclosure Vulnerability

References:

• Carello Product Home Page (Pacific Software)