OpenSolution QuickCart Config Parameter Local File Include Vulnerability

Bugtraq ID:	21411
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 03 2006 12:00AM
Updated:	Dec 04 2006 06:44PM
Credit:	r0ut3r discovered this issue.
Vulnerable:	Opensolution Quick.Cart 2.0
Not Vulnerable:

OpenSolution QuickCart Config Parameter Local File Include Vulnerability

QuickCart is prone to a local file-include vulnerability.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

QuickCart 2.0 is confirmed to be affected.

OpenSolution QuickCart Config Parameter Local File Include Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept exploit is available.

• /data/vulnerabilities/exploits/quick.cart2_lfi_poc.txt

OpenSolution QuickCart Config Parameter Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

OpenSolution QuickCart Config Parameter Local File Include Vulnerability

References:

• Vendor Homepage (Open Solution)