WebDiscount E-Shop Remote Arbitrary Command Execution Vulnerability
BID:3340
Info
WebDiscount E-Shop Remote Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 3340 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-1014 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 15 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | This vulnerability was submitted to BugTraq on September 15th, 2001 by Kernel|X| <[email protected]>. |
| Vulnerable: |
Michael Boehme WebDiscount E-Shop Online-Shop System 1.0 |
| Not Vulnerable: | |
Discussion
WebDiscount E-Shop Remote Arbitrary Command Execution Vulnerability
Webdiscount E-Shop Online Shop System is a web commerce application. It is written and maintained by Michael Boehme.
A problem exists in a default implementation of the software that may allow a user to potentially pass malicious input to the script. This is due insufficient sanitization from untrusted sources. For example, an attacker can use shell metacharacters(';', '|', etc.), which will allow arbitrary commands to be executed by the host with the privileges of the webserver process.
Successful exploitation of this issue may cause sensitive information to be disclosed to the attacker.
Webdiscount E-Shop Online Shop System is a web commerce application. It is written and maintained by Michael Boehme.
A problem exists in a default implementation of the software that may allow a user to potentially pass malicious input to the script. This is due insufficient sanitization from untrusted sources. For example, an attacker can use shell metacharacters(';', '|', etc.), which will allow arbitrary commands to be executed by the host with the privileges of the webserver process.
Successful exploitation of this issue may cause sensitive information to be disclosed to the attacker.
Exploit / POC
WebDiscount E-Shop Remote Arbitrary Command Execution Vulnerability
This issue can be exploited with a web browser.
This issue can be exploited with a web browser.
Solution / Fix
WebDiscount E-Shop Remote Arbitrary Command Execution Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
WebDiscount E-Shop Remote Arbitrary Command Execution Vulnerability
References:
References:
- WebDiscount Homepage (WebDiscount)