Hassan Consulting Shopping Cart Directory Traversal Vulnerability

Bugtraq ID:	1777
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 07 2000 12:00AM
Updated:	Oct 07 2000 12:00AM
Credit:	Posted to Bugtraq on October 7, 2000 by f0bic <[email protected]>.
Vulnerable:	Hassan Consulting Shopping Cart 1.18 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Redhat Linux 7.0 - Redhat Linux 7.0 - Redhat Linux 6.2 sparc - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha - Redhat Linux 6.2 alpha - Sun Solaris 8_sparc - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 7.0
Not Vulnerable:

Hassan Consulting Shopping Cart Directory Traversal Vulnerability

The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will display the specified file:

http://target/cgi-bin/shop.cgi/page=../../../path/filename.ext

Successful exploitation could lead to a remote intruder gaining read access to any known file.

Hassan Consulting Shopping Cart Directory Traversal Vulnerability

http://target/cgi-bin/shop.cgi/page=../../../path/filename.ext

Hassan Consulting Shopping Cart Directory Traversal Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Hassan Consulting Shopping Cart Directory Traversal Vulnerability

References:

• Shopping Cart Product Homepage (Hassan Consulting)