Shop-Script 'index.php' Local Information Disclosure Vulnerability

Bugtraq ID:	27165
Class:	Input Validation Error
CVE:	CVE-2008-0158
Remote:	Yes
Local:	No
Published:	Jan 07 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Fisher762 <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	Shop-Script Shop-Script 2.0
Not Vulnerable:

Shop-Script 'index.php' Local Information Disclosure Vulnerability

Shop-Script is prone to a local information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to access potentially sensitive information that may aid in further attacks.

Shop-Script 2.0 is vulnerable to this issue; other versions may also be affected.

Shop-Script 'index.php' Local Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

The following proof of concept is available:

http://site.com/Script/index.php?aux_page=../../../../../etc/passwd

Shop-Script 'index.php' Local Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Shop-Script 'index.php' Local Information Disclosure Vulnerability

References:

• Shop-Script Homepage (Shop-Script)