PixySoft E-Cart Cat Parameter Remote Command Execution Vulnerability

Bugtraq ID:	13316
Class:	Input Validation Error
CVE:	CVE-2005-1289
Remote:	Yes
Local:	No
Published:	Apr 22 2005 12:00AM
Updated:	Jul 12 2009 02:06PM
Credit:	Discovery is credited to Inaki Cormenzana.
Vulnerable:	PixySoft E-Cart 1.1 AWStats AWStats 6.1 AWStats AWStats 6.0 AWStats AWStats 5.9 AWStats AWStats 5.8 AWStats AWStats 5.7 AWStats AWStats 5.6 AWStats AWStats 5.5 AWStats AWStats 5.4
Not Vulnerable:

PixySoft E-Cart Cat Parameter Remote Command Execution Vulnerability

PixySoft E-Cart is prone to a remote arbitrary command execution vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

Specifically, the user-specified 'cat' URI parameter is supplied to a Perl open() routine.

PixySoft E-Cart versions 1.1 is reported vulnerable to this issue.

PixySoft E-Cart Cat Parameter Remote Command Execution Vulnerability

An exploit is not required.

The following proof of concept is available:
http://www.example.com/DIRTOECART/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|uname%20-a|

PixySoft E-Cart Cat Parameter Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PixySoft E-Cart Cat Parameter Remote Command Execution Vulnerability

References:

• AWStats Homepage (AWStats)
  
• AWStats Vulnerability Analysis ([email protected])
  
• E-Cart Homepage (PixySoft)